Generation of Certificates with Attributes in Hyperledger Fabric

Question

I am following the instructions in the docs to generate an ecert with test attributes. But I am not being able to do it. I am using fabric-ca-client version 1.1.0-preview which according to this issue, should have support for attribute certificates (I have also tried more recent versions).

What I do:

• Enroll the admin:

  $ export FABRIC_CA_CLIENT_HOME=/etc/hyperledger/fabric-ca; fabric-ca-client enroll -u http://admin:adminpw@localhost:7054

• Register the client:

  $ fabric-ca-client register --id.name user1 --id.secret user1pw --id.type user --id.affiliation org1 --id.attrs attr1=val1:ecert

• Enroll the client:

  $ export FABRIC_CA_CLIENT_HOME=/etc/hyperledger/fabric-ca/clients/user1; fabric-ca-client enroll -u http://user1:user1pw@localhost:7054

But then, openssl x509 -in /etc/hyperledger/fabric-ca/clients/user1/msp/signcerts/cert.pem -text -noout shows a certificate without attributes.

Questions:

1. Is it even possible to generate certificates with attributes using the fabric-ca-client utility? According to this issue "The "fabric-ca-client register" CLI command will be enhanced to support ...". But then, in the main documentation, it is explained as if it is already possible to do it.
2. If it is indeed possible, what am I doing (or may be doing) wrong? Since I am using the admin identity to register and enroll the new ecert, I assume there are no restrictions as to what attributes I may add to ecerts (however, I have also tried to follow the conditions stated here).
3. If it is not possible, what is the recommended way to do it? Does generation with any of the SDKs work?

Thanks.

Answer 1

Solved.

It turns out I was not using fabric-ca-client version 1.1.0-preview. With that version, the sequence of commands in the question correctly generate certificates with attributes.