1. 整體概覽
在Fabric 1.0版本中甘苍，原0.6版本中的“Membership Service”已經(jīng)被“Fabric CA”所替代。
Fabric CA是Hyperledger Fabric的證書(shū)頒發(fā)機(jī)構(gòu)列肢，它提供的功能如下：
1）身份的注冊(cè)恰画，或連接到LDAP作為用戶(hù)注冊(cè)表;
2）發(fā)放登記證書(shū)（ECerts）;
3）發(fā)布交易證書(shū)（TCerts），在Hyperledger Fabric blockchain上進(jìn)行交易時(shí)提供匿名性和不可鏈接性;
4）證書(shū)更新和撤銷(xiāo)例书。
Fabric CA包含一個(gè)client端和一個(gè)server端锣尉。在Fabric 1.0版本中，CA可以脫離Docker鏡像决采，作為一個(gè)獨(dú)立的服務(wù)來(lái)運(yùn)行自沧。若使用docker啟動(dòng)，所有的CA服務(wù)都是在一個(gè)專(zhuān)門(mén)的鏡像（名稱(chēng)類(lèi)似于“ca”）中進(jìn)行執(zhí)行树瞭。
Fabric CA提供了兩種訪問(wèn)方式調(diào)用Server服務(wù)拇厢，一種是通過(guò)Client調(diào)用，另一種是通過(guò)SDK調(diào)用晒喷。兩種調(diào)用都是REST風(fēng)格的孝偎。SDK的API接口位于fabric-ca工程的 fabric-ca/swagger/swagger-fabric-ca.json。本文使用的是通過(guò)Client調(diào)用凉敲。
1.1 Fabric CA整體架構(gòu)圖
[1]
Server端由一個(gè)集群組成衣盾，包括前端的一個(gè)高可用的代理服務(wù)器，連接著若干個(gè)CA Server集群爷抓，這些集群將數(shù)據(jù)共同存放在同一個(gè)數(shù)據(jù)服務(wù)器上势决。數(shù)據(jù)庫(kù)可能是MySQL、LDAP蓝撇、PostgresSQL或者SQLite果复。
1.2 Fabric CA運(yùn)行流程的時(shí)序圖
具體步驟包括：
Server端初始化
CA根證書(shū)生成
Server端啟動(dòng)服務(wù)
Client端向Server端請(qǐng)求登記
Server端向Client端返回登記證書(shū)ECert
Client端向Server端請(qǐng)求注冊(cè)節(jié)點(diǎn)
Server端向Client端返回節(jié)點(diǎn)注冊(cè)信息結(jié)果
Client端向Server端請(qǐng)求登記節(jié)點(diǎn)
Server端生成TCert，存入數(shù)據(jù)庫(kù)
Server端向Client端返回登記結(jié)果
2. 安裝
2.1 Dokcer啟動(dòng)
2.1.1 拉取鏡像
docker pull hyperledger/fabric-ca:x86_64-1.0.0-alpha
2.1.2 使用Docker-Compose啟動(dòng)
將下部分代碼添加到 docker-compose.yaml 中的service中渤昌，使用 docker-compose up 啟動(dòng)ca服務(wù)節(jié)點(diǎn)
ca:
image: hyperledger/fabric-ca:x86_64-1.0.0-alpha
container_name: fabric-ca
ports:
- "8888:8888"
environment:
- FABRIC_CA_HOME=/etc/hyperledger/fabric-ca
volumes:
- "./fabric-ca:/etc/hyperledger/fabric-ca"
command: sh -c 'fabric-ca-server start -b admin:adminpw'
2.2 Native啟動(dòng)
2.2.1前提條件
Go 1.7版本或以上
GOPATH環(huán)境配置正確
安裝libtool和libtdhl-dev
2.2.2 安裝方法
可直接使用“go get”命令進(jìn)行安裝虽抄。“go get”相當(dāng)于“git clone”+“go install”
go get -u github.com/hyperledger/fabric-ca/cmd/...
后續(xù)的操作和在Docker中類(lèi)似独柑，這里我們主要講Docker啟動(dòng)的情況迈窟。
3. Fabric-CA-Server
官方說(shuō)明如下：
Hyperledger Fabric Certificate Authority Server
Usage:
fabric-ca-server [command]
Available Commands:
init Initialize the fabric-ca server
start Start the fabric-ca server
Flags:
--address string Listening address of fabric-ca-server (default "0.0.0.0")
-b, --boot string The user:pass for bootstrap admin which is required to build default config file
--ca.certfile string PEM-encoded CA certificate file (default "ca-cert.pem")
--ca.chainfile string PEM-encoded CA chain file (default "ca-chain.pem")
--ca.keyfile string PEM-encoded CA key file (default "ca-key.pem")
-n, --ca.name string Certificate Authority name
-c, --config string Configuration file (default "fabric-ca-server-config.yaml")
--csr.cn string The common name field of the certificate signing request to a parent fabric-ca-server
--csr.serialnumber string The serial number in a certificate signing request to a parent fabric-ca-server
--db.datasource string Data source which is database specific (default "fabric-ca-server.db")
--db.tls.certfiles string PEM-encoded comma separated list of trusted certificate files (e.g. root1.pem, root2.pem)
--db.tls.client.certfile string PEM-encoded certificate file when mutual authenticate is enabled
--db.tls.client.keyfile string PEM-encoded key file when mutual authentication is enabled
--db.tls.enabled Enable TLS for client connection
--db.type string Type of database; one of: sqlite3, postgres, mysql (default "sqlite3")
-d, --debug Enable debug level logging
--ldap.enabled Enable the LDAP client for authentication and attributes
--ldap.groupfilter string The LDAP group filter for a single affiliation group (default "(memberUid=%s)")
--ldap.url string LDAP client URL of form ldap://adminDN:adminPassword@host[:port]/base
--ldap.userfilter string The LDAP user filter to use when searching for users (default "(uid=%s)")
-p, --port int Listening port of fabric-ca-server (default 7054)
--registry.maxenrollments int Maximum number of enrollments; valid if LDAP not enabled
--tls.certfile string PEM-encoded TLS certificate file for server's listening port (default "ca-cert.pem")
--tls.enabled Enable TLS on the listening port
--tls.keyfile string PEM-encoded TLS key for server's listening port (default "ca-key.pem")
-u, --url string URL of the parent fabric-ca-server
Use "fabric-ca-server [command] --help" for more information about a command.
3.1 初始化Server服務(wù)
3.1.1 指令介紹
fabric-ca-server init -b admin:adminpw
-b在這里指的是bootstrap，也就是啟動(dòng)加載狀態(tài)忌栅。
有一個(gè)名為 fabric-ca-server-config.yaml 的配置文件會(huì)在節(jié)點(diǎn)啟動(dòng)時(shí)自動(dòng)生成菠隆。我們也可以根據(jù)里面的內(nèi)容自定義配置CSR信息，使用 --config 文件名來(lái)進(jìn)行啟動(dòng)配置狂秘。
CSR為“Certificate Signing Request”的縮寫(xiě)，即證書(shū)簽名請(qǐng)求躯肌。
目前在keys中支持的算法和相關(guān)長(zhǎng)度如下：
Fabric-CA 1.0支持MySQL者春、LDAP、PostgresSQL和SQLite清女，這里配置用的是默認(rèn)的SQLite钱烟。其他配置方法暫且不表。
3.1.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-server init -b admin:adminpw
2017/03/21 08:54:23 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/fabric-ca-server-config.yaml
2017/03/21 08:54:23 Initialize BCCSP [SW]
2017/03/21 08:54:23 [INFO] The CA key and certificate files already exist
2017/03/21 08:54:23 [INFO] Key file location: /etc/hyperledger/fabric-ca/ca-key.pem
2017/03/21 08:54:23 [INFO] Certificate file location: /etc/hyperledger/fabric-ca/ca-cert.pem
2017/03/21 08:54:23 [INFO] Initialized sqlite3 data base at /etc/hyperledger/fabric-ca/fabric-ca-server.db
2017/03/21 08:54:23 [INFO] Initialization was successful
3.2 啟動(dòng)Server服務(wù)
3.2.1 指令介紹
fabric-ca-server start -b <admin style="box-sizing: border-box;">:<adminpw style="box-sizing: border-box;"></adminpw></admin>
這里，默認(rèn)調(diào)用的啟動(dòng)配置文件為fabric-ca-server-config.yaml拴袭，如果需要自定義配置读第，還是使用 --config 文件名來(lái)進(jìn)行啟動(dòng)配置。
成功后拥刻，server端會(huì)在預(yù)先配置的環(huán)境路徑下生成相應(yīng)的ca證書(shū)文件怜瞒，并在配置的端口號(hào)上進(jìn)行服務(wù)監(jiān)聽(tīng)拄查。這里我們?cè)诙丝?888上進(jìn)行監(jiān)聽(tīng)枉阵。
3.2.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-server start -b admin:adminpw
2017/03/21 08:54:50 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/fabric-ca-server-config.yaml
2017/03/21 08:54:50 Initialize BCCSP [SW]
2017/03/21 08:54:50 [INFO] The CA key and certificate files already exist
2017/03/21 08:54:50 [INFO] Key file location: /etc/hyperledger/fabric-ca/ca-key.pem
2017/03/21 08:54:50 [INFO] Certificate file location: /etc/hyperledger/fabric-ca/ca-cert.pem
2017/03/21 08:54:50 [INFO] Initialized sqlite3 data base at /etc/hyperledger/fabric-ca/fabric-ca-server.db
2017/03/21 08:54:50 [INFO] Listening at http://0.0.0.0:8888
4. Fabric-CA-Client
官方說(shuō)明如下：
Hyperledger Fabric Certificate Authority Client
Usage:
fabric-ca-client [command]
Available Commands:
enroll Enroll user
getcacert Get CA certificate chain
reenroll Reenroll user
register Register user
revoke Revoke user
Flags:
-c, --config string Configuration file (default "/etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml")
--csr.cn string The common name field of the certificate signing request to a parent fabric-ca-server
--csr.serialnumber string The serial number in a certificate signing request to a parent fabric-ca-server
-d, --debug Enable debug level logging
--enrollment.hosts string Comma-separated host list
--enrollment.label string Label to use in HSM operations
--enrollment.profile string Name of the signing profile to use in issuing the certificate
--id.affiliation string The identity's affiliation
--id.attr string Attributes associated with this identity (e.g. hf.Revoker=true)
--id.maxenrollments int The maximum number of times the secret can be reused to enroll.
--id.name string Unique name of the identity
--id.secret string The enrollment secret for the identity being registered
--id.type string Type of identity being registered (e.g. 'peer, app, user')
-M, --mspdir string Membership Service Provider directory (default "msp")
-m, --myhost string Hostname to include in the certificate signing request during enrollment (default "0f86c3e1cf15")
--tls.certfiles string PEM-encoded comma separated list of trusted certificate files (e.g. root1.pem, root2.pem)
--tls.client.certfile string PEM-encoded certificate file when mutual authenticate is enabled
--tls.client.keyfile string PEM-encoded key file when mutual authentication is enabled
--tls.enabled Enable TLS for client connection
-u, --url string URL of fabric-ca-server (default "http://localhost:7054")
Use "fabric-ca-client [command] --help" for more information about a command.
4.1啟動(dòng)用戶(hù)登記
4.1.1 指令介紹
fabric-ca-client enroll -u http://admin:adminpw@localhost:8888
登記啟動(dòng)用戶(hù)會(huì)在用戶(hù)的home路徑下生成登記證書(shū)文件ECert讨跟。
4.1.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-client enroll -u http://admin:adminpw@localhost:8888
2017/03/21 08:59:09 [INFO] User provided config file: /etc/hyperledger/fabric-ca/fabric-ca-client-config.yaml
2017/03/21 08:59:09 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/fabric-ca-client-config.yaml
2017/03/21 08:59:09 Initialize BCCSP [SW]
2017/03/21 08:59:09 [INFO] received CSR
2017/03/21 08:59:09 [INFO] generating key: ecdsa-256
2017/03/21 08:59:09 [INFO] encoded CSR
2017/03/21 08:59:09 [INFO] Stored client key at /etc/hyperledger/fabric-ca/msp/keystore/key.pem
2017/03/21 08:59:09 [INFO] Stored client certificate at /etc/hyperledger/fabric-ca/msp/signcerts/cert.pem
2017/03/21 08:59:09 [INFO] Stored CA certificate chain at /etc/hyperledger/fabric-ca/msp/cacerts/.pem
4.2 新身份注冊(cè)
4.2.1 指令介紹
fabric-ca-client register
在注冊(cè)階段凑兰，server端需要檢查被注冊(cè)對(duì)象的兩方面內(nèi)容：
1 被注冊(cè)的對(duì)象的角色一定要在預(yù)先配置的“hf.Registrar.Roles”屬性中約定的范圍內(nèi)钾埂。比如圆凰，如果“hf.Registrar.Roles”約定的角色包括“peer”和“client”婶恼，那么被注冊(cè)對(duì)象就只能是這兩個(gè)角色中的一個(gè)燃乍，如果被注冊(cè)對(duì)象的角色為“user”楞卡，那么注冊(cè)就不能被通過(guò)霜运。
2 被注冊(cè)對(duì)象的從屬關(guān)系參數(shù)一定要?dú)w屬于預(yù)先配置的組織屬性。換句話說(shuō)蒋腮，被注冊(cè)對(duì)象的affiliation參數(shù)一定要是預(yù)先配置的affiliation參數(shù)的一個(gè)前綴淘捡。例如，假設(shè)預(yù)先配置的組織關(guān)系為：“a.b.c”徽惋，那么新注冊(cè)的對(duì)象的affiliation屬性可以是“a.b.c”案淋，也可以是“a.b”，但“a.c”就不能通過(guò)注冊(cè)险绘。
下面是id配置的一個(gè)示例：
id:
name: MyPeer1
type: peer
affiliation: org1.department1
attributes:
- name: SomeAttrName
value: SomeAttrValue
- name: foo
value: bar
如果想要在后面允許對(duì)這個(gè)ID進(jìn)行注銷(xiāo)踢京，在這里配置的attributes中要包含“hf.Revoker”，即：
attributes:
- name: hf.Revoker
value: true
4.2.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-client register --id.name cliTest00
2017/03/21 09:05:16 [INFO] User provided config file: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 09:05:16 Initialize BCCSP [SW]
2017/03/21 09:05:16 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
Password: oLtPkJRCzdTH
這里隨機(jī)生成了一個(gè)Password宦棺，將在后面的節(jié)點(diǎn)登記中用到瓣距。
在指令中使用flag來(lái)臨時(shí)自定義用戶(hù)名和密碼：--id.name <用戶(hù)名> --id.secret <密碼>
4.3 節(jié)點(diǎn)身份登記
4.3.1 指令介紹
官方文檔上說(shuō)，在節(jié)點(diǎn)身份登記之前代咸，要先指定FABRIC_CA_CERT_FILE和FABRIC_CA_KEY_FILE兩個(gè)環(huán)境變量蹈丸，生成的peer.pem和key.pem兩個(gè)證書(shū)文件作為T(mén)Cert。但是我的試驗(yàn)中呐芥，生成的證書(shū)文件路徑仍然是在FABRIC_CA_CLIENT_HOME相應(yīng)的路徑下逻杖，不知是否是仍然存在的bug。
export FABRIC_CA_CERT_FILE=$MSP_DIR/signcerts/peer.pem
export FABRIC_CA_KEY_FILE=$MSP_DIR/keystore/key.pem
fabric-ca client enroll -u http://<peer id="" style="box-sizing: border-box;">:<password style="box-sizing: border-box;">@localhost:port</password></peer>
這里Peer ID為注冊(cè)時(shí)的id name思瘟，password為上文提到的注冊(cè)時(shí)生成的密碼荸百。
4.3.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-client enroll -u http://cliTest00:oLtPkJRCzdTH@localhost:8888
2017/03/21 09:07:48 [INFO] User provided config file: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 09:07:48 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 09:07:48 Initialize BCCSP [SW]
2017/03/21 09:07:48 [INFO] received CSR
2017/03/21 09:07:48 [INFO] generating key: ecdsa-256
2017/03/21 09:07:48 [INFO] encoded CSR
2017/03/21 09:07:48 [INFO] Stored client key at /etc/hyperledger/fabric-ca/clients/admin/msp/keystore/key.pem
2017/03/21 09:07:48 [INFO] Stored client certificate at /etc/hyperledger/fabric-ca/clients/admin/msp/signcerts/cert.pem
2017/03/21 09:07:48 [INFO] Stored CA certificate chain at /etc/hyperledger/fabric-ca/clients/admin/msp/cacerts/.pem
4.4 身份重登記
4.4.1 指令介紹
fabric-ca-client reenroll
當(dāng)?shù)怯浀纳矸葸^(guò)期時(shí)，可以利用reenroll命令對(duì)身份進(jìn)行重新登記滨攻。注意够话，這個(gè)指令后面不能添加登記的名稱(chēng)和密碼蓝翰，只是按照之前配置好的內(nèi)容進(jìn)行重新登記。
4.4.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-client reenroll
2017/03/21 10:11:36 [INFO] User provided config file: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 10:11:36 Initialize BCCSP [SW]
2017/03/21 10:11:36 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 10:11:36 [INFO] received CSR
2017/03/21 10:11:36 [INFO] generating key: ecdsa-256
2017/03/21 10:11:37 [INFO] encoded CSR
2017/03/21 10:11:37 [INFO] Stored client key at /etc/hyperledger/fabric-ca/clients/admin/msp/keystore/key.pem
2017/03/21 10:11:37 [INFO] Stored client certificate at /etc/hyperledger/fabric-ca/clients/admin/msp/signcerts/cert.pem
2017/03/21 10:11:37 [INFO] Stored CA certificate chain at /etc/hyperledger/fabric-ca/clients/admin/msp/cacerts/.pem
4.5 證書(shū)或身份撤銷(xiāo)
4.5.1 指令介紹
Usage:
fabric-ca-client revoke [flags]
Flags:
-a, --aki string AKI
-e, --eid string Enrollment ID (Optional)
-r, --reason string Reason for revoking
-s, --serial string Serial Number
官方給出的說(shuō)明有些錯(cuò)誤女嘲，被標(biāo)（Optional）的應(yīng)該是“Reason for revoking”部分畜份。實(shí)際上，要求指令后面的flag內(nèi)容為下面兩種格式中的一種：
fabric-ca-client revoke -a xxx -s yyy -r<reason style="box-sizing: border-box;"></reason>
或
fabric-ca-client revoke -e <enrollment_id style="box-sizing: border-box;">-r<reason style="box-sizing: border-box;"></reason></enrollment_id>
支持的<reason style="box-sizing: border-box;">包括：</reason>
Reasons:
unspecified
keycompromise
cacompromise
affiliationchange
superseded
cessationofoperation
certificatehold
removefromcrl
privilegewithdrawn
aacompromise
AKI（Authority Key Identifier）和Serial Number都是在身份登記后生成的cert.pem文件中欣尼。我們需要對(duì)這個(gè)文件進(jìn)行解析爆雹。可以使用OpenSSL進(jìn)行解析：
root@xiao-virtual-machine:/home/xiao/test/fabric-ca/clients/admin/msp/signcerts# openssl x509 -in cert.pem -text -noout -serial
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
4a:ad:ce:89:16:9d:36:23:99:c5:37:7a:e9:2b:06:d7:8a:f3:f3:da
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=US, ST=North Carolina, O=Hyperledger, OU=Fabric, CN=fabric-ca-server
Validity
Not Before: Mar 21 09:21:00 2017 GMT
Not After : Feb 17 17:21:00 2018 GMT
Subject: C=US, ST=North Carolina, O=Hyperledger, OU=Fabric, CN=test001
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:8a:ff:a4:44:2c:10:e5:4c:4e:7d:7d:0f:bb:28:
aa:c0:30:b8:53:2c:0d:1d:26:92:c9:85:7c:0d:24:
7a:c0:25:5c:18:c9:f7:fa:d2:53:e9:00:00:99:d1:
04:30:a1:d5:dd:a1:3c:30:37:5a:f9:70:e5:aa:6e:
89:6c:54:ad:18
ASN1 OID: prime256v1
X509v3 extensions:
X509v3 Key Usage: critical
Certificate Sign
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Key Identifier:
6F:76:CA:12:7D:20:5F:27:6F:93:55:15:48:F1:32:6C:83:2A:F6:03
X509v3 Authority Key Identifier:
keyid:A5:1F:27:F8:09:78:46:4D:63:A8:23:48:B3:B4:01:1D:FB:FF:C9:43
X509v3 Subject Alternative Name:
DNS:38cdca9067ac
Signature Algorithm: ecdsa-with-SHA256
30:46:02:21:00:a6:3e:33:78:e2:59:8c:e2:ba:6f:0f:7b:01:
66:5d:67:08:af:81:de:1b:47:20:c1:00:e5:11:ba:1e:7a:f1:
f2:02:21:00:95:1a:31:06:6e:ab:cd:91:85:02:38:8c:72:87:
70:8e:e5:bc:7d:a8:0f:05:a1:55:60:c9:49:a0:72:1d:a1:11
serial=4AADCE89169D362399C5377AE92B06D78AF3F3DA
這里媒至，AKI為
A5:1F:27:F8:09:78:46:4D:63:A8:23:48:B3:B4:01:1D:FB:FF:C9:43
(需要去除冒號(hào)）顶别，Serial Number為
4AADCE89169D362399C5377AE92B06D78AF3F3DA
4.5.2 示例
root@0f86c3e1cf15:/etc/hyperledger/fabric-ca# fabric-ca-client revoke -e test01
2017/03/21 11:11:05 [INFO] User provided config file: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 11:11:05 Initialize BCCSP [SW]
2017/03/21 11:11:05 [INFO] Configuration file location: /etc/hyperledger/fabric-ca/clients/admin/fabric-ca-client-config.yaml
2017/03/21 11:11:05 [INFO] Revocation was successful
這里只是表述了通過(guò)eid進(jìn)行撤銷(xiāo)的方式，另一種方法總是不能成功拒啰，與Hyperledger項(xiàng)目組的成員溝通后驯绎，說(shuō)是存在bug，目前仍在修復(fù)中谋旦。所以這里暫且不表剩失。
5. 其他
5.1 優(yōu)先級(jí)
命令執(zhí)行的優(yōu)先級(jí)從高到低依次是：
1 命令行flag
2 環(huán)境變量
3 配置文件
References
[1] https://github.com/hyperledger/fabric/blob/master/docs/source/Setup/ca-setup.rst
