Thank you guys so much, it's really helpful!

Hello,

I am working with a team and we are trying to use an _existing_ deployment of a Hyperledger Fabric 1.4 network that is private (this becomes important later), as configured on the AWS Managed Blockchain platform. I presume I cannot modify the certificate authority, only access it the way it is provided, so I need to know how to work around this without blowing away all the members and the network to start from scratch.

Can you enroll a admin member with the member CA if there is a hostname mismatch?

So far, we reached this portion of official AWS documentation.

https://docs.aws.amazon.com/managed-blockchain/latest/hyperledger-fabric-dev/get-started-enroll-admin.html

When we use our CA configuration data it does not work _as-is_ with the given configuration. We are not using a public network, so this configuration is a hard requirement by AWS (until we advance further). We must a VPC endpoint to access the member certificate authority by an internal IP address via a special VPC Endpoint DNS record, not public. AWS does not seem to have an option for a private network with public addresses. So, when following this post, we get back obvious cert name mismatches when sending the CSR.

To start, we are using 1.4.7 pulled down from GitHub releases yesterday.

$ ~/go/src/github.com/hyperledger/fabric-ca/bin/fabric-ca-client version
fabric-ca-client:
Version: 1.4.7
Go version: go1.13.9
OS/Arch: linux/amd64

We set out our CAENDPOINT to a VPC endpoint, which is valid, but slightly different hostname from the official endpoint.

vpce-0123456789010-abcdefg-us-east-1c.n-mynetworkid.managedblockchain.us-east-1.vpce.amazonaws.com:30002

Notice this is different from what AWS tells us the member CA is, but that is intentional and by design. This is what you would see in the console as the official member CA endpoint.

ca.mymemberid.n-mynetworkid.managedblockchain.us-east-1.amazonaws.com:30002 (NOTE: this does not even show up in DNS by design, it will not resolve, this is to force you to use the aforementioned API endpoints only through private addresses via VPC endpoints.)

So when we do this, either the client (but more likely the CA server right?) says hey, those hostnames don't mismatch, I am ignoring your CSR, better luck next time.

$ ~/go/src/github.com/hyperledger/fabric-ca/bin/fabric-ca-client enroll -u "https://adminuser:adminpassword@$CASERVICEENDPOINT" --tls.certfiles ~/managedblockchain-tsl-chain.pem -m ~/admin-msp
2021/12/17 19:38:27 [INFO] TLS Enabled
2021/12/17 19:38:27 [INFO] generating key: &{A:ecdsa S:256}
2021/12/17 19:38:27 [INFO] encoded CSR
Error: POST failure of request: POST https://vpce-0123456789010-abcdefg-us-east-1c.n-mynetworkidce.managedblockchain.us-east-1.vpce.amazonaws.com:30002/enroll
{"hosts":["/home/ec2-user/admin-msp"],"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\\n-----END CERTIFICATE REQUEST-----\n","profile":"","crl_override":"","label":"","NotBefore":"0001-01-01T00:00:00Z","NotAfter":"0001-01-01T00:00:00Z","CAName":""}: Post https://vpce-0123456789010-abcdefg-us-east-1c.n-mynetworkid.managedblockchain.us-east-1.vpce.amazonaws.com:30002/enroll: x509: certificate is valid for nd-blahblahblah.m-mymemberid.n-mynetworkid.managedblockchain.us-east-1.amazonaws.com, localhost, ca.m-mymemberid.n-mynetworkid.managedblockchain.us-east-1.amazonaws.com, not vpce-0123456789010-abcdefg-us-east-1c.n-mynetworkidce.managedblockchain.us-east-1.vpce.amazonaws.com

Again ca.mymemberid.n-mynetworkid.managedblockchain.us-east-1.amazonaws.com will not resolve and this is by design, but luckily it seems a proper HTTPS POST request came back, albeit with an error.

Is there are any way to force a CSR with a hostname mismatch from the client side, or is this a (member CA) server-side only thing?

This is a managed Hyperledger Fabric deployment, so I do not think we can modify the CA server config. Is there are any way to force this with the fabric-ca-client-config.yaml?

Am I missing something obvious? Sorry, I am new to Fabric and the docs do not help me with this level of detail.

Best,
AJ

Hi everyone,

• https://github.com/hyperledger/fabric-sdk-java/releases
• https://search.maven.org/artifact/org.hyperledger.fabric-sdk-java/fabric-sdk-java/2.2.10/jar
• https://search.maven.org/artifact/org.hyperledger.fabric-sdk-java/fabric-sdk-java/1.4.14/jar

--

Thanks for your attention: https://github.com/hyperledger/fabric-chaincode-java/issues/218

Unless stated otherwise above:

IBM United Kingdom Limited - Registered in England and Wales with number 741598.

Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU

Environment: fabric release-2.2
My chaincode named vulnerable is as follows:


When I invoke helloworld directly, it gives me responce "helloworld", everything works fine.

But when I invoke invokeChaincode method, it gives me



and chaincode docker container logging is as follows:



It seems like
(1) the statement System.out.printf("\n%s\n", chaincodeName) works fine.
(2) org.hyperledger.fabric.shim.impl.InvocationStubImpl.invokeChaincode also finds the registered method helloworld, but it encountered another exception half way the invocation.

Does anyone met this problem before?
Thanks in advance.

Hi, thanks for your reply.
I'm using fabric release-2.2, and deployed a test network on a clean environment. I have the following phenomena:
(1) When I use cmd docker exec peer0.org1.example.com peer channel getinfo -c mychannel and docker exec peer0.org2.example.com peer channel getinfo -c mychannel, I got the same result, which means there's no state inconsistency.
(2) When I change the endorsement policy of the chaincode vulenrable to "OR('Org1MSP.peer','Org2MSP.peer')"
     everything works fine. 

Conclusion: If we deploy a chaincode with (1) privatedata config above, (2) endorsement policy like  "AND('Org1MSP.peer','Org2MSP.peer')", then this chaincode fail with endorsement conflict.

Is this a bug? I haven't get deeper inspection of the reason.

You're right, the private data collection should have nothing to do with that error. That error typically means state is not identical across the peers and therefore the chaincode results do not match. In a production system with load it can be caused by peers at different block heights at time of chaincode execution. If you are seeing it on a system at rest then there may be something wrong with one of your peers. Are you able to reproduce it on a clean environment?

If you'd like to troubleshoot this environment, you can take state snapshots on both peers (https://hyperledger-fabric.readthedocs.io/en/release-2.4/peer_ledger_snapshot.html) and then compare the snapshots with the new ledgerutil that was delivered in v2.4 (https://hyperledger-fabric.readthedocs.io/en/release-2.4/commands/ledgerutil.html).


Dave Enyeart

"BigBang019" ---12/15/2021 07:50:47 AM---*Scenario* : 1. I have a chaicode named *vulnerable* with a *collection-config* as follows:

From: "BigBang019" <zhuxy0000@...>
To: fabric@...
Date: 12/15/2021 07:50 AM
Subject: [EXTERNAL] [Hyperledger Fabric] Question about PrivateData Endorsement in Hyperledger Fabric #fabric-endorser
Sent by: fabric@...

---

Scenario: 1. I have a chaicode named vulnerable with a collection-config as follows: and transaction functions as follows But I didn't give any endorsement policy to this chaincode, which means its endorsement policy are supposed to be  ZjQcmQRYFpfptBannerStart 
This Message Is From an External Sender
This message came from outside your organization.
ZjQcmQRYFpfptBannerEnd
Scenario:
1. I have a chaicode named vulnerable with a collection-config as follows:

and transaction functions as follows

But I didn't give any endorsement policy to this chaincode, which means its endorsement policy are supposed to be "MAJORITY Endorsement".
2. Now I deployed a network with 2 Orgs and 1 Peer per Org, i.e. I have 2 peers in total.
3. When I invoke this chaincode through fabric-sdk-go, as follows

It gives me:

I'm really confused, because everything works fine before I add that collection-config.

Could you please give any help on this situation?

Thanks in advance.

Scenario:
1. I have a chaicode named vulnerable with a collection-config as follows:

and transaction functions as follows

But I didn't give any endorsement policy to this chaincode, which means its endorsement policy are supposed to be "MAJORITY Endorsement".
2. Now I deployed a network with 2 Orgs and 1 Peer per Org, i.e. I have 2 peers in total.
3. When I invoke this chaincode through fabric-sdk-go, as follows

It gives me:

I'm really confused, because everything works fine before I add that collection-config.

Could you please give any help on this situation?

Thanks in advance.

Extending the previous question. How can I use the scripts to deploy a second channel with an other chaincode (the asset-transfer-basic but with an other name in avoid problems in the peers). I tried to channel the ENV TEST_NETWORK_CHANNEL_NAME before creating the channel and then change TEST_NETWORK_CHAINCODE_LABEL before deploying the chaincode. However, during invoke and query the commands stall.

--

--

Private Chaincode Lab

When:
12/14/2021
8:00am to 9:00am
(UTC-08:00) America/Los Angeles

Where:
https://zoom.us/my/hyperledger.community.3?pwd=UE90WHhEaHRqOGEyMkV3cldKa2d2dz09

Organizer: Marcus Brandenburger bur@...

View Event

Description:
Two of the Hyperleger Labs projects (private data objects and private chain code) are collaborating to develop a "private smart contracts" capability.

Join Zoom Meeting https://zoom.us/j/5184947650?pwd=UE90WHhEaHRqOGEyMkV3cldKa2d2dz09 Meeting ID: 518 494 7650 Passcode: 475869

Hello;

On Approach #2..

> Do we still need to install the chaincode in the peer, if we are running the peer in dev mode inside a docker container ?
No, the approach you are doing is basically correct; using a different packaging of Fabric, but with the same concepts https://hyperledgendary.github.io/docs/tutorials/hyperfast_contract_development.html I was successful in the same approach

Have you tried using the `fabric-samples` test-network?  I'd be concerned if there's something wrong in the initial setup that is causing later issues. The error suggests to me that the peer still thinks this chaincode is going to be used in non-dev mode. 

 

Matthew White
IBM Blockchain Development