x509:证书对rca-ord有效，而不是localhost。

Question

我们已经启动了一个fabric-ca服务器实例，在docker-compose.yml中设置了以下设置

version: '2'

networks:
  test:

services:

  myservice:
    container_name: my-container
    image: hyperledger/fabric-ca
    command: /bin/bash -c "fabric-ca-server start -b admin:adminpw"
    environment:
      - FABRIC_CA_SERVER_HOME=/etc/hyperledger/fabric-ca
      - FABRIC_CA_SERVER_TLS_ENABLED=true
      - FABRIC_CA_SERVER_CSR_CN=rca-ord
      - FABRIC_CA_SERVER_CSR_HOSTS=rca-ord
      - FABRIC_CA_SERVER_DEBUG=true
    volumes:
      - ./scripts:/scripts
      - ./data:/data
    networks:
      - test
    ports:
      - 7054:7054

但是，当我们尝试使用以下命令在此服务器上注册用户时：

root@fd85cc416f52:/# fabric-ca-client enroll -u https://user:userpw@localhost:7054 --tls.certfiles $FABRIC_CA_SERVER_HOME/tls-cert.pem

我们得到以下错误：

2018/12/08 22:18:03 [INFO] TLS Enabled
2018/12/08 22:18:03 [INFO] generating key: &{A:ecdsa S:256}
2018/12/08 22:18:03 [INFO] encoded CSR
Error: POST failure of request: POST https://localhost:7054/enroll
{"hosts":["fd85cc416f52"],"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBQDCB6AIBADBcMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xp\nbmExFDASBgNVBAoTC0h5cGVybGVkZ2VyMQ8wDQYDVQQLEwZGYWJyaWMxDTALBgNV\nBAMTBHVzZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATREdPvOeaWG9TzaEyk\nhFXRnJFJouDXShr0D1745bCt/0n3qjpqviZiApd1t62VrpMX0j8DBa6tkF7C+rEr\nRvwnoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxmZDg1Y2M0MTZmNTIw\nCgYIKoZIzj0EAwIDRwAwRAIgASXupobxJia/FFlLiwYzYpacvSA6RiIc/LR/kvdB\nT8ICIA1nJ2RfHrwMhOWocxMAIuLUsBvKS3S5DIwCHp0/gBpn\n-----END CERTIFICATE REQUEST-----\n","profile":"","crl_override":"","label":"","NotBefore":"0001-01-01T00:00:00Z","NotAfter":"0001-01-01T00:00:00Z","CAName":""}: Post https://localhost:7054/enroll: x509: certificate is valid for rca-ord, not localhost

在服务器端，我们可以看到在发送请求时打印出以下消息：

my-container | 2018/12/08 22:18:03 http: TLS handshake error from 127.0.0.1:56518: remote error: tls: bad certificate

我们还努力：

root@fd85cc416f52:/# ls $FABRIC_CA_SERVER_HOME
IssuerPublicKey  IssuerRevocationPublicKey  ca-cert.pem  fabric-ca-server-config.yaml  fabric-ca-server.db  msp  tls-cert.pem
root@fd85cc416f52:/# fabric-ca-client enroll -u https://user:userpw@localhost:7054 --tls.certfiles $FABRIC_CA_SERVER_HOME/ca-cert.pem

有同样的结果

想知道是否有人能帮助我们，这里有什么问题，我们如何解决？谢谢

Answer 1

您已经使用FABRIC_CA_SERVER_CSR_HOSTS=rca-ord在服务器上生成了一个TLS证书，但随后在注册命令中指定的URL中将请求发送给localhost。

要使其工作，您应该将环境变量更改为还包括“localhost”。例如：FABRIC_CA_SERVER_CSR_HOSTS=rca-ord,localhost。

删除旧的TLS证书并生成一个新的证书，它应该可以工作。