CODEWITHSUNDEEP
hyperledger-fabric-ca
morpheus
morpheus

Reputation: 20290

Hyperledger Fabric CA: x509: certificate is valid for rca-ord, not localhost

we have started an instance of fabric-ca-server with following settings in docker-compose.yml

version: '2'

networks:
  test:

services:

  myservice:
    container_name: my-container
    image: hyperledger/fabric-ca
    command: /bin/bash -c "fabric-ca-server start -b admin:adminpw"
    environment:
      - FABRIC_CA_SERVER_HOME=/etc/hyperledger/fabric-ca
      - FABRIC_CA_SERVER_TLS_ENABLED=true
      - FABRIC_CA_SERVER_CSR_CN=rca-ord
      - FABRIC_CA_SERVER_CSR_HOSTS=rca-ord
      - FABRIC_CA_SERVER_DEBUG=true
    volumes:
      - ./scripts:/scripts
      - ./data:/data
    networks:
      - test
    ports:
      - 7054:7054

but when we try to enroll a user against this server using the command below:

root@fd85cc416f52:/# fabric-ca-client enroll -u https://user:userpw@localhost:7054 --tls.certfiles $FABRIC_CA_SERVER_HOME/tls-cert.pem

we get the error below:

2018/12/08 22:18:03 [INFO] TLS Enabled
2018/12/08 22:18:03 [INFO] generating key: &{A:ecdsa S:256}
2018/12/08 22:18:03 [INFO] encoded CSR
Error: POST failure of request: POST https://localhost:7054/enroll
{"hosts":["fd85cc416f52"],"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBQDCB6AIBADBcMQswCQYDVQQGEwJVUzEXMBUGA1UECBMOTm9ydGggQ2Fyb2xp\nbmExFDASBgNVBAoTC0h5cGVybGVkZ2VyMQ8wDQYDVQQLEwZGYWJyaWMxDTALBgNV\nBAMTBHVzZXIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATREdPvOeaWG9TzaEyk\nhFXRnJFJouDXShr0D1745bCt/0n3qjpqviZiApd1t62VrpMX0j8DBa6tkF7C+rEr\nRvwnoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxmZDg1Y2M0MTZmNTIw\nCgYIKoZIzj0EAwIDRwAwRAIgASXupobxJia/FFlLiwYzYpacvSA6RiIc/LR/kvdB\nT8ICIA1nJ2RfHrwMhOWocxMAIuLUsBvKS3S5DIwCHp0/gBpn\n-----END CERTIFICATE REQUEST-----\n","profile":"","crl_override":"","label":"","NotBefore":"0001-01-01T00:00:00Z","NotAfter":"0001-01-01T00:00:00Z","CAName":""}: Post https://localhost:7054/enroll: x509: certificate is valid for rca-ord, not localhost

on the server-side we can see following message printed out when the request is sent:

my-container | 2018/12/08 22:18:03 http: TLS handshake error from 127.0.0.1:56518: remote error: tls: bad certificate

we have also tried:

root@fd85cc416f52:/# ls $FABRIC_CA_SERVER_HOME
IssuerPublicKey  IssuerRevocationPublicKey  ca-cert.pem  fabric-ca-server-config.yaml  fabric-ca-server.db  msp  tls-cert.pem
root@fd85cc416f52:/# fabric-ca-client enroll -u https://user:userpw@localhost:7054 --tls.certfiles $FABRIC_CA_SERVER_HOME/ca-cert.pem

with same result

wondering if someone can help us what is wrong here and how can we fix it? thanks

Upvotes: 5

Views: 4596

Answers (1)

Saad Karim
Saad Karim

Reputation: 239

You have generated a TLS certificate on the server using FABRIC_CA_SERVER_CSR_HOSTS=rca-ord, but then you are sending your request to localhost in the URL you specify in the enroll command.

To get this to work, you should change your environment variable to also include 'localhost'. For example: FABRIC_CA_SERVER_CSR_HOSTS=rca-ord,localhost.

Delete the old TLS certificate and generate a new one, and it should work.

Upvotes: 1

Related Questions