Abhijeet Bhowmik <abhijeet@...>
Hello Everyone.
I have followed this thorough discussion on crypto operations in HLF. Very enlightening. I would like to have a deep dig into internal working of CA's and significance of each type of certificates/keys/artifacts present in the folder structure of peer's crypto material. It really confuses me how in an ensemble of N organizations, 1 organization proves his authenticity and control over an entity and how other N-1 orgs verify it's signature on txn. I simply take this as how SSL works. Signing the hash with private key to create digitally signed Entity which is verifiable using Public Key. But now I am really confused as while using crypto-gen, I never bothered about placing public keys of different orgs at every orgs and then configure them to use it. It would be very much appreciated if someone points me towards the right direction to learn how HLF pulls off Blockchain magic at atomic level. I don't intend to bring up a HLF architecture as a black box. I need an insight.
Thanks and Regards
Abhijeet Bhowmik
On Wed, Nov 6, 2019 at 9:53 PM Nye Liu < nye@...> wrote:
If this is truly the case, using two instances of ca-server
(one for TLS, one for non-tls) should be trivial, as well as
generating self signed root certs to bootstrap the ca server, as
well as distributing the public root and intermediates to the
various components.
fabric-ca-client enroll can be used for literally everything
else (including TLS generation).
On 11/6/2019 8:18 AM, hakan eryargi
wrote:
Well, being the author of these Helm charts, I
believe I have a quite good understanding of what cryptogen
generates and where to mount them ;)
For extending the network, ”cryptogen extend”
command does a very good job, only creates what is missing,
either new organizations or new peers in the organization.
I still fail to see any real issue for using
cryptogen.
It creates self signed certificates, not an
issue for us.
It doesnt support intermediate certificates: not
a requirement for us.
It puts San Fransisco or sth to some value in
the certificates, not nice but not a real issue.
So, still, it’s the most convenient way as of
now for us.
I also need to say, it’s easy to say “dont use
it in production” without providing a good alternative. As
mentioned earlier, I just dont want to create certificates
manually, neither want to write some scripts for that.
Best,
Hakan
On Wed, 6 Nov 2019 at 16:39,
Nye Liu < nye@...> wrote:
Either way, a network is not static. At some point you
are going to have to issue new MSPs, and in order to do
that, you have to have an understanding of both the
ca-server and the structure and purpose of every part of
an MSP.
cryptogen both hides this from you, and does not permit
easily adding new credentials and orginizations.
In addition, cryptogen does some other very
questionable things when it fires up a bunch of
credentials as well (in the name of PoC and unit
testing) - in particular, the overlap of TLS and
non-transport credentials/CAs which is never
recommended.
Do not use it for production networks.
On 11/6/2019 5:47 AM, Hakan Eryargi wrote:
Hi Jean-Gaël and Joe,
This is not my understanding.
1. Fabric doesnt care about if root certificate
is self-signed or not. Root certificate of an
organization is encoded in the genesis block,
Fabric only cares about it.
2. CA doesnt create the root certificate, you
need feed it the root certificate so it can create
other certificates. Peer, user, admin etc.
So either using CA or not, one needs to create
the root certificate. IMHO doesnt really matter if
self-signed or not. After that, it's a matter of
choice use CA or cryptogen to create
other certificates.
Please correct me if i am wrong about above.
Otherwise I dont see a real issue about using
cryptogen in production.
In our flow, we create all the initial
certificates with cryptogen, launch the network
including CA's, then use CA to register users. Our
intention is using the same flow in production too
unless someone provides a more convenient tool to
create the initial certificates.
Best,
Hakan
Hakan,
Generating certificates using a
Certificate Authority (and not cryptogen) is a
fact of life for Hyperledger Fabric users who
are interested in deploying something in
production. Cryptogen is a handy tool for
application developers who only want to deploy
a network they can test smart contracts and
apps against and explicitly not meant (or
supported) for production networks. It's
analogous to printing your own identification
card at home and expecting that government
agencies and businesses will accept it as
being valid.
The sooner you get used to
creating certificates and MSPs using a CA, the
better off you will be.
Regards,
Joe
Alewine
IBM
Blockchain, Raleigh
rocket
chat: joe-alewine
slack:
joe.alewine
-----
Original message -----
From: hakan eryargi <hakan.eryargi@...>
To: Abhijeet Bhowmik <abhijeet@...>
Cc: Joe Alewine <joe.alewine@...>,
fabric@...
Subject: [EXTERNAL] Re: [Hyperledger Fabric]
Alternative of cryptogen for Prod
Date: Wed, Nov 6, 2019 7:29 AM
Hi,
To my knowledge, cryptogen is the most
convenient tool for now to create the
initial certificates.
I dont want to create the certificates
manually, nor want to write some scripts
for certificate creation. Maybe cryptogen
is not intended for this purpose but best
option for now, especially if you dont
need additional stuff in certificates.
So,
if there is no real issue with
it, like a security threat or whatever,
we plan to go production with cryptogen
.
It
will also be nice if cryptogen is even
more developed to cover other needs too
:)
Best,
Hakan
On Tue, Nov 5, 2019 at 4:40
AM Abhijeet Bhowmik < abhijeet@...>
wrote:
Hey,
Thanks to all for the help. I am
extremely grateful to everyone.
Abhijeet Bhowmik
Abhijeet,
Certificate
Authorities --- specifically, the
Fabric CA --- should be used to
create all of the certificates in
a production scenario (it is a
best practice tp stand up one CA
for each organization and the
organization's related identities,
MSP, and nodes).
Regards,
Joe Alewine
IBM Blockchain, Raleigh
rocket chat: joe-alewine
slack: joe.alewine
-----
Original message -----
From: "Nye Liu" <nye@...>
Sent by: fabric@...
To: fabric@...
Cc:
Subject: [EXTERNAL] Re:
[Hyperledger Fabric] Alternative
of cryptogen for Prod
Date: Sun, Nov 3, 2019 7:43 AM
It is described in the
Operations Guide.
On 11/3/2019 1:11 AM,
Abhijeet Bhowmik wrote:
Hey,
Just to be specific, I
was referring to the
certificates that we set up
at peers and place public
keys at orderer. From where
do we obtain that folder
structure (MSP and TLS)?
Thanks and Regards
Abhijeet Bhowmik
For prod,
you’ll need to generate
certs from CAs.
References:
Cheers,
Mrudav
On Sun, 3
Nov 2019 at 10:22 AM,
Abhijeet Bhowmik < abhijeet@...>
wrote:
Greetings
Everyone,
I am dwelling
in the answer of
the question: "If
not cryptogen in
Prod, then what
and how?".
Right now,
generating org
certificates is a
pretty
straightforward
task while getting
started with HLF.
But after reading
the docs, the
question has been
thrown upon me
that how can we
configure
certificates in
Prod. I know it's
a naive question
to ask but being a
beginner and
stepping my first
foot into actually
hosting fabric
application, I am
obliged to ask the
community to help
me out.
Thanks and
Regards
Abhijeet
Bhowmik
|
