CODEWITHSUNDEEP
hyperledger-fabrichyperledger
Mrudav Shukla
Mrudav Shukla

Reputation: 708

Hyperledger Fabric: Do we need to pass TLS cert/key files while joining channel?

I have a multi-org network fabric network up and running from different hosts.

The docker containers for the peers have TLS enabled. The build configuration of the peer:

- CORE_PEER_TLS_ENABLED=true
- CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
- CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
- CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt

While creating and joining the channel I followed byfn docs and did not supply the TLS cert/file of the peer while joining the channel. All the peers were able to join the channel.

However, when I tried to fetch the newest block using peer channel fetch newest -o orderer.example.com:7050 -c examplechannel, I got the error:

Serve failed to complete security handshake from "ip:43402": tls: first record does not look like a TLS handshake

Further, I referred this doc on TLS and this doc on passing TLS certs of the peer with the above fetch command:

peer channel fetch newest -o orderer.example.com:7050 -c examplechannel --tls --certfile $CORE_PEER_TLS_CERT_FILE --keyfile $CORE_PEER_TLS_KEY_FILE --cafile $CORE_PEER_TLS_ROOTCERT_FILE

This gave a new error:

grpc: Server.Serve failed to complete security handshake from "ip:43496": remote error: tls: bad certificate

Debugging TLS issues doc states that this happens when the server does not trust the client certificate. So in my case, I infer that the orderer is not trusting the certificate that the peer is passing.

So

  1. Does it mean that I was supposed to pass TLS_CERT, TLS_KEY and TLS_ROOT cert while proposing a channel join from this peer?
  2. If #1 is true, can I pass these certificates without bringing down the network and rejoining the channel with certs?
  3. While creating the channel, it uses orderer's ca-cert. Also, when submitting anchor peer transaction, it uses orderer's ca cert? So am I supposed to use Orderer's ca cert for peer fetch command as well?
  4. If #3 is true, then in a production environment, do we need to build up the peer containers such that it contains orderer's ca-cert?

Upvotes: 4

Views: 2791

Answers (1)

Gari Singh
Gari Singh

Reputation: 12013

There are multiple concepts baked into your questions. It's important to understand that there is a difference between using the peer to run a peer node--peer node start-- and using the peer as a CLI (e.g. peer channel fetch).

When the peer is running as a server, there's no need to pass in crypto material for the channels as the peer actually extracts the required TLS certificate information from the config block passed in the peer channel join ... command.

When the peer is running in CLI mode, you do need to provide the the TLS certificate information to connect to the various endpoints. When communicating with peers, this information is extracted from the peer config (either in core.yaml or from the corresponding CORE_ environment variables). When communicating with the orderer, there are specific command line flags for setting the TLS material.

Upvotes: 3

Related Questions