Skip to content

Commit 0ae00c8

Browse files
author
Anil Ambati
committedApr 26, 2017
[FAB-3107] Replace 'user' with 'identity'
Replace all references to 'user' with 'identity' in the doc Also, updated fabric-ca-server and fabric-ca-client command help, removed yml comments that said certfiles property is comma separated values. Change-Id: I2d399634080a1533b77af596b4296c6dbd856911 Signed-off-by: Anil Ambati <aambati@us.ibm.com>
·
v3.1.0v1.0.0-alpha2
1 parent e0dc9e3 commit 0ae00c8

File tree

1 file changed

+148
-142
lines changed

1 file changed

+148
-142
lines changed
 

‎docs/source/Setup/ca-setup.rst

+148-142
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ servers. This is illustrated in the top right section of the diagram.
7878
The client routes to an HA Proxy endpoint which load balances traffic to one
7979
of the fabric-ca-server cluster members.
8080
All Fabric CA servers in a cluster share the same database for
81-
keeping track of users and certificates. If LDAP is configured, the user
81+
keeping track of identities and certificates. If LDAP is configured, the identity
8282
information is kept in LDAP rather than the database.
8383

8484
Getting Started
@@ -154,34 +154,39 @@ The following shows the Fabric CA server usage message.
154154
fabric-ca-server [command]
155155

156156
Available Commands:
157-
init Initialize the fabric-ca server
158-
start Start the fabric-ca server
157+
init Initialize the Fabric CA server
158+
start Start the Fabric CA server
159159

160160
Flags:
161-
--address string Listening address of fabric-ca-server (default "0.0.0.0")
162-
-b, --boot string The user:pass for bootstrap admin which is required to build default config file
163-
--ca.certfile string PEM-encoded CA certificate file (default "ca-cert.pem")
164-
--ca.keyfile string PEM-encoded CA key file (default "ca-key.pem")
165-
-c, --config string Configuration file (default "fabric-ca-server-config.yaml")
166-
--csr.cn string The common name field of the certificate signing request to a parent fabric-ca-server
167-
--csr.serialnumber string The serial number in a certificate signing request to a parent fabric-ca-server
168-
--db.datasource string Data source which is database specific (default "fabric-ca-server.db")
169-
--db.tls.certfiles string PEM-encoded comma separated list of trusted certificate files (e.g. root1.pem, root2.pem)
170-
--db.tls.client.certfile string PEM-encoded certificate file when mutual authentication is enabled
171-
--db.tls.client.keyfile string PEM-encoded key file when mutual authentication is enabled
172-
--db.tls.enabled Enable TLS for client connection
173-
--db.type string Type of database; one of: sqlite3, postgres, mysql (default "sqlite3")
174-
-d, --debug Enable debug level logging
175-
--ldap.enabled Enable the LDAP client for authentication and attributes
176-
--ldap.groupfilter string The LDAP group filter for a single affiliation group (default "(memberUid=%s)")
177-
--ldap.url string LDAP client URL of form ldap://adminDN:adminPassword@host[:port]/base
178-
--ldap.userfilter string The LDAP user filter to use when searching for users (default "(uid=%s)")
179-
-p, --port int Listening port of fabric-ca-server (default 7054)
180-
--registry.maxenrollments int Maximum number of enrollments; valid if LDAP not enabled
181-
--tls.certfile string PEM-encoded TLS certificate file for server's listening port (default "ca-cert.pem")
182-
--tls.enabled Enable TLS on the listening port
183-
--tls.keyfile string PEM-encoded TLS key for server's listening port (default "ca-key.pem")
184-
-u, --url string URL of the parent fabric-ca-server
161+
--address string Listening address of Fabric CA server (default "0.0.0.0")
162+
-b, --boot string The user:pass for bootstrap admin which is required to build default config file
163+
--ca.certfile string PEM-encoded CA certificate file (default "ca-cert.pem")
164+
--ca.chainfile string PEM-encoded CA chain file (default "ca-chain.pem")
165+
--ca.keyfile string PEM-encoded CA key file (default "ca-key.pem")
166+
-n, --ca.name string Certificate Authority name
167+
-c, --config string Configuration file (default "fabric-ca-server-config.yaml")
168+
--csr.cn string The common name field of the certificate signing request to a parent Fabric CA server
169+
--csr.hosts stringSlice A list of space-separated host names in a certificate signing request to a parent Fabric CA server
170+
--csr.serialnumber string The serial number in a certificate signing request to a parent Fabric CA server
171+
--db.datasource string Data source which is database specific (default "fabric-ca-server.db")
172+
--db.tls.certfiles stringSlice PEM-encoded list of trusted certificate files
173+
--db.tls.client.certfile string PEM-encoded certificate file when mutual authenticate is enabled
174+
--db.tls.client.keyfile string PEM-encoded key file when mutual authentication is enabled
175+
--db.type string Type of database; one of: sqlite3, postgres, mysql (default "sqlite3")
176+
-d, --debug Enable debug level logging
177+
--ldap.enabled Enable the LDAP client for authentication and attributes
178+
--ldap.groupfilter string The LDAP group filter for a single affiliation group (default "(memberUid=%s)")
179+
--ldap.url string LDAP client URL of form ldap://adminDN:adminPassword@host[:port]/base
180+
--ldap.userfilter string The LDAP user filter to use when searching for users (default "(uid=%s)")
181+
-p, --port int Listening port of Fabric CA server (default 7054)
182+
--registry.maxenrollments int Maximum number of enrollments; valid if LDAP not enabled
183+
--tls.certfile string PEM-encoded TLS certificate file for server's listening port (default "ca-cert.pem")
184+
--tls.clientauth.certfiles stringSlice PEM-encoded list of trusted certificate files
185+
--tls.clientauth.type string Policy the server will follow for TLS Client Authentication. (default "noclientcert")
186+
--tls.enabled Enable TLS on the listening port
187+
--tls.keyfile string PEM-encoded TLS key for server's listening port (default "ca-key.pem")
188+
-u, --url string URL of the parent Fabric CA server
189+
185190

186191
Use "fabric-ca-server [command] --help" for more information about a command.
187192

@@ -196,16 +201,17 @@ The following shows the Fabric CA client usage message:
196201
fabric-ca-client [command]
197202

198203
Available Commands:
199-
enroll Enroll user
204+
enroll Enroll an identity
200205
getcacert Get CA certificate chain
201-
reenroll Reenroll user
202-
register Register user
203-
revoke Revoke user
206+
reenroll Reenroll an identity
207+
register Register an identity
208+
revoke Revoke an identity
204209

205210
Flags:
206211
-c, --config string Configuration file (default "$HOME/.fabric-ca-client/fabric-ca-client-config.yaml")
207-
--csr.cn string The common name field of the certificate signing request to a parent fabric-ca-server
208-
--csr.serialnumber string The serial number in a certificate signing request to a parent fabric-ca-server
212+
--csr.cn string The common name field of the certificate signing request
213+
--csr.hosts stringSlice A list of space-separated host names in a certificate signing request
214+
--csr.serialnumber string The serial number in a certificate signing request
209215
-d, --debug Enable debug level logging
210216
--enrollment.hosts string Comma-separated host list
211217
--enrollment.label string Label to use in HSM operations
@@ -218,14 +224,14 @@ The following shows the Fabric CA client usage message:
218224
--id.type string Type of identity being registered (e.g. 'peer, app, user')
219225
-M, --mspdir string Membership Service Provider directory (default "msp")
220226
-m, --myhost string Hostname to include in the certificate signing request during enrollment (default "$HOSTNAME")
221-
--tls.certfiles string PEM-encoded comma separated list of trusted certificate files (e.g. root1.pem, root2.pem)
222-
--tls.client.certfile string PEM-encoded certificate file when mutual authentication is enabled
227+
--tls.certfiles stringSlice PEM-encoded list of trusted certificate files
228+
--tls.client.certfile string PEM-encoded certificate file when mutual authenticate is enabled
223229
--tls.client.keyfile string PEM-encoded key file when mutual authentication is enabled
224-
--tls.enabled Enable TLS for client connection
225-
-u, --url string URL of fabric-ca-server (default "http://localhost:7054")
230+
-u, --url string URL of the Fabric CA server (default "http://localhost:7054")
226231

227232
Use "fabric-ca-client [command] --help" for more information about a command.
228233

234+
Note that command line options that are string slices (lists) can be specified either by specifying the option with space-separated list elements or by specifying the option multiple times, each with a string value that make up the list. For example, to specify ``host1`` and ``host2`` for `csr.hosts` option, you can either pass `--csr.hosts "host1 host2"` or `--csr.hosts host1 --csr.hosts host2`
229235

230236
`Back to Top`_
231237

@@ -270,25 +276,25 @@ the server's home directory (see `Fabric CA Server <#server>`__ section more inf
270276
keyfile: ca-key.pem
271277

272278
#############################################################################
273-
# The registry section controls how the fabric-ca-server does two things:
274-
# 1) authenticates enrollment requests which contain a username and password
275-
# (also known as an enrollment ID and secret).
279+
# The registry section controls how the Fabric CA server does two things:
280+
# 1) authenticates enrollment requests which contain identity name and
281+
# password (also known as enrollment ID and secret).
276282
# 2) once authenticated, retrieves the identity's attribute names and
277-
# values which the fabric-ca-server optionally puts into TCerts
283+
# values which the Fabric CA server optionally puts into TCerts
278284
# which it issues for transacting on the Hyperledger Fabric blockchain.
279285
# These attributes are useful for making access control decisions in
280286
# chaincode.
281287
# There are two main configuration options:
282-
# 1) The fabric-ca-server is the registry
283-
# 2) An LDAP server is the registry, in which case the fabric-ca-server
288+
# 1) The Fabric CA server is the registry
289+
# 2) An LDAP server is the registry, in which case the Fabric CA server
284290
# calls the LDAP server to perform these tasks.
285291
#############################################################################
286292
registry:
287293
# Maximum number of times a password/secret can be reused for enrollment
288294
# (default: 0, which means there is no limit)
289295
maxEnrollments: 0
290296

291-
# Contains user information which is used when LDAP is disabled
297+
# Contains identity information which is used when LDAP is disabled
292298
identities:
293299
- name: <<<ADMIN>>>
294300
pass: <<<ADMINPW>>>
@@ -306,24 +312,25 @@ the server's home directory (see `Fabric CA Server <#server>`__ section more inf
306312
# The datasource value depends on the type.
307313
# If the type is "sqlite3", the datasource value is a file name to use
308314
# as the database store. Since "sqlite3" is an embedded database, it
309-
# may not be used if you want to run the fabric-ca-server in a cluster.
310-
# To run the fabric-ca-server in a cluster, you must choose "postgres"
315+
# may not be used if you want to run the Fabric CA server in a cluster.
316+
# To run the Fabric CA server in a cluster, you must choose "postgres"
311317
# or "mysql".
312318
#############################################################################
313319
db:
314320
type: sqlite3
315321
datasource: fabric-ca-server.db
316322
tls:
317323
enabled: false
318-
certfiles: db-server-cert.pem
324+
certfiles:
325+
- db-server-cert.pem
319326
client:
320327
certfile: db-client-cert.pem
321328
keyfile: db-client-key.pem
322329

323330
#############################################################################
324331
# LDAP section
325-
# If LDAP is enabled, the fabric-ca-server calls LDAP to:
326-
# 1) authenticate enrollment ID and secret (i.e. username and password)
332+
# If LDAP is enabled, the Fabric CA server calls LDAP to:
333+
# 1) authenticate enrollment ID and secret (i.e. identity name and password)
327334
# for enrollment requests
328335
# 2) To retrieve identity attributes
329336
#############################################################################
@@ -333,7 +340,8 @@ the server's home directory (see `Fabric CA Server <#server>`__ section more inf
333340
# The URL of the LDAP server
334341
url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>
335342
tls:
336-
certfiles: ldap-server-cert.pem
343+
certfiles:
344+
- ldap-server-cert.pem
337345
client:
338346
certfile: ldap-client-cert.pem
339347
keyfile: ldap-client-key.pem
@@ -407,7 +415,7 @@ the client's home directory (see `Fabric CA Client <#client>`__ section more inf
407415
# Client Configuration
408416
#############################################################################
409417

410-
# URL of the fabric-ca-server (default: http://localhost:7054)
418+
# URL of the Fabric CA server (default: http://localhost:7054)
411419
URL: http://localhost:7054
412420

413421
# Membership Service Provider (MSP) directory
@@ -421,7 +429,7 @@ the client's home directory (see `Fabric CA Client <#client>`__ section more inf
421429
tls:
422430
# Enable TLS (default: false)
423431
enabled: false
424-
certfiles: # Comma Separated (e.g. root.pem, root2.pem)
432+
certfiles:
425433
client:
426434
certfile:
427435
keyfile:
@@ -446,18 +454,18 @@ the client's home directory (see `Fabric CA Client <#client>`__ section more inf
446454
expiry:
447455

448456
#############################################################################
449-
# Registration section used to register a new user with fabric-ca server
457+
# Registration section used to register a new identity with Fabric CA server
450458
#############################################################################
451459
id:
452460
name:
453461
type:
454462
affiliation:
455-
attrs:
463+
attributes:
456464
- name:
457465
value:
458466

459467
#############################################################################
460-
# Enrollment section used to enroll a user with fabric-ca server
468+
# Enrollment section used to enroll an identity with Fabric CA server
461469
#############################################################################
462470
enrollment:
463471
hosts:
@@ -469,8 +477,8 @@ the client's home directory (see `Fabric CA Client <#client>`__ section more inf
469477
Configuration Settings Precedence
470478
---------------------------------
471479

472-
The Fabric CA provides 3 ways to configure settings on the fabric-ca-server
473-
and fabric-ca-client. The precedence order is:
480+
The Fabric CA provides 3 ways to configure settings on the Fabric CA server
481+
and client. The precedence order is:
474482

475483
1. CLI flags
476484
2. Environment variables
@@ -489,7 +497,7 @@ For example, if we have the following in the client configuration file:
489497
enabled: false
490498

491499
# TLS for the client's listenting port (default: false)
492-
certfiles: # Comma Separated (e.g. root.pem, root2.pem)
500+
certfiles:
493501
client:
494502
certfile: cert.pem
495503
keyfile:
@@ -526,7 +534,8 @@ directory, ``cert.pem`` file in the ``~/config/certs`` directory and the
526534

527535
tls:
528536
enabled: true
529-
certfiles: root.pem
537+
certfiles:
538+
- root.pem
530539
client:
531540
certfile: certs/cert.pem
532541
keyfile: /abs/path/key.pem
@@ -538,11 +547,9 @@ Fabric CA Server
538547

539548
This section describes the Fabric CA server.
540549

541-
You may initialize the Fabric CA server before starting it if you prefer.
542-
This provides an opportunity for you to generate a default configuration
543-
file but to review and customize its settings before starting it.
550+
You may initialize the Fabric CA server before starting it. This provides an opportunity for you to generate a default configuration file but to review and customize its settings before starting it.
544551

545-
| The fabric-ca-server's home directory is determined as follows:
552+
| The Fabric CA server's home directory is determined as follows:
546553
| - if the ``FABRIC_CA_SERVER_HOME`` environment variable is set, use
547554
its value;
548555
| - otherwise, if ``FABRIC_CA_HOME`` environment variable is set, use
@@ -569,14 +576,14 @@ Initialize the Fabric CA server as follows:
569576

570577
# fabric-ca-server init -b admin:adminpw
571578

572-
The ``-b`` (bootstrap user) option is required for initialization. At
573-
least one bootstrap user is required to start the fabric-ca-server. The
579+
The ``-b`` (bootstrap identity) option is required for initialization. At
580+
least one bootstrap identity is required to start the Fabric CA server. The
574581
server configuration file contains a Certificate Signing Request (CSR)
575582
section that can be configured. The following is a sample CSR.
576583

577-
If you are going to connect to the fabric-ca-server remotely over TLS,
584+
If you are going to connect to the Fabric CA server remotely over TLS,
578585
replace "localhost" in the CSR section below with the hostname where you
579-
will be running your fabric-ca-server.
586+
will be running your Fabric CA server.
580587

581588
.. _csr-fields:
582589

@@ -614,7 +621,7 @@ command again.
614621
The ``fabric-ca-server init`` command generates a self-signed CA certificate
615622
unless the ``-u <parent-fabric-ca-server-URL>`` option is specified.
616623
If the ``-u`` is specified, the server's CA certificate is signed by the
617-
parent fabric-ca-server. The ``fabric-ca-server init`` command also
624+
parent Fabric CA server. The ``fabric-ca-server init`` command also
618625
generates a default configuration file named **fabric-ca-server-config.yaml**
619626
in the server's home directory.
620627

@@ -671,10 +678,10 @@ server will generate the ca-cert.pem and ca-key.pem files if they don't
671678
yet exist and will also create a default configuration file if it does
672679
not exist. See the `Initialize the Fabric CA server <#initialize>`__ section.
673680

674-
Unless the fabric-ca-server is configured to use LDAP, it must be
675-
configured with at least one pre-registered bootstrap user to enable you
681+
Unless the Fabric CA server is configured to use LDAP, it must be
682+
configured with at least one pre-registered bootstrap identity to enable you
676683
to register and enroll other identities. The ``-b`` option specifies the
677-
name and password for a bootstrap user.
684+
name and password for a bootstrap identity.
678685

679686
A different configuration file may be specified with the ``-c`` option
680687
as shown below.
@@ -683,32 +690,32 @@ as shown below.
683690

684691
# fabric-ca-server start -c <path-to-config-file> -b <admin>:<adminpw>
685692

686-
To cause the fabric-ca-server to listen on ``https`` rather than
693+
To cause the Fabric CA server to listen on ``https`` rather than
687694
``http``, set ``tls.enabled`` to ``true``.
688695

689696
To limit the number of times that the same secret (or password) can be
690697
used for enrollment, set the ``registry.maxEnrollments`` in the configuration
691-
file to the appropriate value. If you set the value to 1, the fabric-ca
698+
file to the appropriate value. If you set the value to 1, the Fabric CA
692699
server allows passwords to only be used once for a particular enrollment
693-
ID. If you set the value to 0, the fabric-ca-server places no limit on
700+
ID. If you set the value to 0, the Fabric CA server places no limit on
694701
the number of times that a secret can be reused for enrollment. The
695702
default value is 0.
696703

697-
The fabric-ca-server should now be listening on port 7054.
704+
The Fabric CA server should now be listening on port 7054.
698705

699706
You may skip to the `Fabric CA Client <#fabric-ca-client>`__ section if
700-
you do not want to configure the fabric-ca-server to run in a cluster or
707+
you do not want to configure the Fabric CA server to run in a cluster or
701708
to use LDAP.
702709

703710
Configuring the database
704711
~~~~~~~~~~~~~~~~~~~~~~~~
705712

706-
This section describes how to configure the fabric-ca-server to connect
713+
This section describes how to configure the Fabric CA server to connect
707714
to Postgres or MySQL databases. The default database is SQLite and the
708715
default database file is ``fabric-ca-server.db`` in the Fabric CA
709716
server's home directory.
710717

711-
If you don't care about running the fabric-ca-server in a cluster, you
718+
If you don't care about running the Fabric CA server in a cluster, you
712719
may skip this section; otherwise, you must configure either Postgres or
713720
MySQL as described below.
714721

@@ -758,15 +765,15 @@ values for sslmode are:
758765
| | signed by a |
759766
| | trusted CA and |
760767
| | the server |
761-
| | host name |
768+
| | hostname |
762769
| | matches the |
763770
| | one in the |
764771
| | certificate |
765772
+----------------+----------------+
766773

767774
|
768775
769-
If you would like to use TLS, then the ``db.tls`` section in the fabric-ca-server
776+
If you would like to use TLS, then the ``db.tls`` section in the Fabric CA server
770777
configuration file must be specified. If SSL client authentication is enabled
771778
on the Postgres server, then the client certificate and key file must also be
772779
specified in the ``db.tls.client`` section. The following is an example
@@ -778,18 +785,19 @@ of the ``db.tls`` section:
778785
...
779786
tls:
780787
enabled: true
781-
certfiles: db-server-cert.pem
788+
certfiles:
789+
- db-server-cert.pem
782790
client:
783791
certfile: db-client-cert.pem
784792
keyfile: db-client-key.pem
785793

786-
| **certfiles** - Comma separated list of PEM-encoded trusted root certificate files.
794+
| **certfiles** - A list of PEM-encoded trusted root certificate files.
787795
| **certfile** and **keyfile** - PEM-encoded certificate and key files that are used by the Fabric CA server to communicate securely with the Postgres server
788796
789797
MySQL
790798
^^^^^^^
791799

792-
The following sample may be added to the fabric-ca-server config file in
800+
The following sample may be added to the Fabric CA server configuration file in
793801
order to connect to a MySQL database. Be sure to customize the various
794802
values appropriately.
795803

@@ -805,16 +813,16 @@ section is also required as described in the **Postgres** section above.
805813
Configuring LDAP
806814
~~~~~~~~~~~~~~~~
807815

808-
The fabric-ca-server can be configured to read from an LDAP server.
816+
The Fabric CA server can be configured to read from an LDAP server.
809817

810-
In particular, the fabric-ca-server may connect to an LDAP server to do
818+
In particular, the Fabric CA server may connect to an LDAP server to do
811819
the following:
812820

813-
- authenticate a user prior to enrollment
814-
- retrieve a user's attribute values which are used for authorization.
821+
- authenticate an identity prior to enrollment
822+
- retrieve an identity's attribute values which are used for authorization.
815823

816-
Modify the LDAP section of the server's configuration file to configure the
817-
fabric-ca-server to connect to an LDAP server.
824+
Modify the LDAP section of the Fabric CA server's configuration file to configure the
825+
server to connect to an LDAP server.
818826

819827
::
820828

@@ -858,21 +866,21 @@ server.
858866
When LDAP is configured, enrollment works as follows:
859867

860868

861-
- The fabric-ca-client or client SDK sends an enrollment request with a
869+
- The Fabric CA client or client SDK sends an enrollment request with a
862870
basic authorization header.
863-
- The fabric-ca-server receives the enrollment request, decodes the
864-
user name and password in the authorization header, looks up the DN (Distinquished
865-
Name) associated with the user name using the "userfilter" from the
866-
configuration file, and then attempts an LDAP bind with the user's
871+
- The Fabric CA server receives the enrollment request, decodes the
872+
identity name and password in the authorization header, looks up the DN (Distinquished
873+
Name) associated with the identity name using the "userfilter" from the
874+
configuration file, and then attempts an LDAP bind with the identity's
867875
password. If the LDAP bind is successful, the enrollment processing is
868876
authorized and can proceed.
869877

870878
When LDAP is configured, attribute retrieval works as follows:
871879

872880

873881
- A client SDK sends a request for a batch of tcerts **with one or more
874-
attributes** to the fabric-ca-server.
875-
- The fabric-ca-server receives the tcert request and does as follows:
882+
attributes** to the Fabric CA server.
883+
- The Fabric CA server receives the tcert request and does as follows:
876884

877885
- extracts the enrollment ID from the token in the authorization
878886
header (after validating the token);
@@ -883,10 +891,10 @@ When LDAP is configured, attribute retrieval works as follows:
883891
Setting up a cluster
884892
~~~~~~~~~~~~~~~~~~~~
885893

886-
You may use any IP sprayer to load balance to a cluster of fabric-ca
894+
You may use any IP sprayer to load balance to a cluster of Fabric CA
887895
servers. This section provides an example of how to set up Haproxy to
888-
route to a fabric-ca-server cluster. Be sure to change hostname and port
889-
to reflect the settings of your fabric-ca servers.
896+
route to a Fabric CA server cluster. Be sure to change hostname and port
897+
to reflect the settings of your Fabric CA servers.
890898

891899
haproxy.conf
892900

@@ -911,7 +919,7 @@ haproxy.conf
911919
server server3 hostname3:port
912920

913921

914-
Node: If using TLS, need to use ``mode tcp``.
922+
Note: If using TLS, need to use ``mode tcp``.
915923

916924
`Back to Top`_
917925

@@ -922,7 +930,7 @@ Fabric CA Client
922930

923931
This section describes how to use the fabric-ca-client command.
924932

925-
| The fabric-ca-client's home directory is determined as follows:
933+
| The Fabric CA client's home directory is determined as follows:
926934
| - if the ``FABRIC_CA_CLIENT_HOME`` environment variable is set, use
927935
its value;
928936
| - otherwise, if the ``FABRIC_CA_HOME`` environment variable is set,
@@ -935,12 +943,12 @@ This section describes how to use the fabric-ca-client command.
935943
The instructions below assume that the client configuration file exists
936944
in the client's home directory.
937945

938-
Enrolling the bootstrap user
939-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
946+
Enrolling the bootstrap identity
947+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
940948

941949
First, if needed, customize the CSR (Certificate Signing Request) section
942950
in the client configuration file. Note that ``csr.cn`` field must be set
943-
to the ID of the bootstrap user. Default CSR values are shown below:
951+
to the ID of the bootstrap identity. Default CSR values are shown below:
944952

945953
::
946954

@@ -964,41 +972,40 @@ to the ID of the bootstrap user. Default CSR values are shown below:
964972

965973
See `CSR fields <#csr-fields>`__ for description of the fields.
966974

967-
Then run ``fabric-ca-client enroll`` command to enroll the user. For example,
968-
following command enrolls an user whose ID is **admin** and password is **adminpw**
969-
by calling fabric-ca-server that is running locally at 7054 port.
975+
Then run ``fabric-ca-client enroll`` command to enroll the identity. For example,
976+
following command enrolls an identity whose ID is **admin** and password is **adminpw**
977+
by calling Fabric CA server that is running locally at 7054 port.
970978

971979
::
972980

973981
# export FABRIC_CA_CLIENT_HOME=$HOME/fabric-ca/clients/admin
974982
# fabric-ca-client enroll -u http://admin:adminpw@localhost:7054
975983

976984
The enroll command stores an enrollment certificate (ECert), corresponding private key and CA
977-
certificate chain PEM files in the subdirectories of the fabric-ca-client's ``msp`` directory.
985+
certificate chain PEM files in the subdirectories of the Fabric CA client's ``msp`` directory.
978986
You will see messages indicating where the PEM files are stored.
979987

980988
Registering a new identity
981989
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
982990

983-
The user performing the register request must be currently enrolled, and
984-
must also have the proper authority to register the type of user being
991+
The identity performing the register request must be currently enrolled, and
992+
must also have the proper authority to register the type of the identity that is being
985993
registered.
986994

987-
In particular, two authorization checks are made by the fabric-ca-server
995+
In particular, two authorization checks are made by the Fabric CA server
988996
during registration as follows:
989997

990998
1. The invoker's identity must have the "hf.Registrar.Roles" attribute with a
991999
comma-separated list of values where one of the value equals the type of
9921000
identity being registered; for example, if the invoker's identity has the
993-
"hf.Registrar.Roles" attribute with a value of "peer,app,user", the invoker
994-
can register identities of type peer, app, and user, but not orderer.
1001+
"hf.Registrar.Roles" attribute with a value of "peer,app,user", the invoker can register identities of type peer, app, and user, but not orderer.
9951002

9961003
2. The affiliation of the invoker's identity must be equal to or a prefix of
9971004
the affiliation of the identity being registered. For example, an invoker
9981005
with an affiliation of "a.b" may register an identity with an affiliation
9991006
of "a.b.c" but may not register an identity with an affiliation of "a.c".
10001007

1001-
The following command uses the **admin** user's credentials to register a new
1008+
The following command uses the **admin** identity's credentials to register a new
10021009
identity with an enrollment id of "admin2", a type of "user", an affiliation of
10031010
"org1.department1", and an attribute named "hf.Revoker" with a value of "true".
10041011

@@ -1008,9 +1015,9 @@ identity with an enrollment id of "admin2", a type of "user", an affiliation of
10081015
# fabric-ca-client register --id.name admin2 --id.type user --id.affiliation org1.department1 --id.attr hf.Revoker=true
10091016

10101017
The password, also known as the enrollment secret, is printed.
1011-
This password is required to enroll the user.
1012-
This allows an administrator to register an identity and to then give the
1013-
enrollment ID and secret to someone else to enroll the identity.
1018+
This password is required to enroll the identity.
1019+
This allows an administrator to register an identity and give the
1020+
enrollment ID and the secret to someone else to enroll the identity.
10141021

10151022
You may set default values for any of the fields used in the register command
10161023
by editing the client's configuration file. For example, suppose the configuration
@@ -1022,23 +1029,23 @@ file contains the following:
10221029
name:
10231030
type: user
10241031
affiliation: org1.department1
1025-
attrs:
1032+
attributes:
10261033
- name: hf.Revoker
10271034
value: true
10281035
- name: anotherAttrName
10291036
value: anotherAttrValue
10301037

10311038
The following command would then register a new identity with an enrollment id of
10321039
"admin3" which it takes from the command line, and the remainder is taken from the
1033-
config file including a type of "user", an affiliation of "org1.department1", and two attributes:
1034-
"hf.Revoker" with a value of "true" and "anotherAttrName" with a value of "anotherAttrValue".
1040+
configuration file including the identity type: "user", affiliation: "org1.department1",
1041+
and two attributes: "hf.Revoker" and "anotherAttrName".
10351042

10361043
::
10371044

10381045
# export FABRIC_CA_CLIENT_HOME=$HOME/fabric-ca/clients/admin
10391046
# fabric-ca-client register --id.name admin3
10401047

1041-
To register a user with multiple attributes requires specifying all attribute names and values
1048+
To register an identity with multiple attributes requires specifying all attribute names and values
10421049
in the configuration file as shown above.
10431050

10441051
Next, let's register a peer identity which will be used to enroll the peer in the following section.
@@ -1055,7 +1062,7 @@ Enrolling a Peer Identity
10551062

10561063
Now that you have successfully registered a peer identity, you may now
10571064
enroll the peer given the enrollment ID and secret (i.e. the *password*
1058-
from the previous section). This is similar to enrolling the bootstrap user
1065+
from the previous section). This is similar to enrolling the bootstrap identity
10591066
except that we also demonstrate how to use the "-M" option to populate the
10601067
Hyperledger Fabric MSP (Membership Service Provider) directory structure.
10611068

@@ -1073,16 +1080,16 @@ You may also set the FABRIC_CA_CLIENT_HOME to the home directory of your peer.
10731080
Enrolling an orderer is the same, except the path to the MSP directory is
10741081
the 'LocalMSPDir' setting in your orderer's orderer.yaml file.
10751082

1076-
Getting a CA certificate chain from another fabric-ca-server
1083+
Getting a CA certificate chain from another Fabric CA server
10771084
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10781085

10791086
In general, the cacerts directory of the MSP directory must contain the certificate authority chains
10801087
of other certificate authorities, representing all of the roots of trust for the peer.
10811088

10821089
The ``fabric-ca-client getcacerts`` command is used to retrieve these certificate chains from other
1083-
fabric-ca-server instances.
1090+
Fabric CA server instances.
10841091

1085-
For example, the following will start a second fabric-ca-server on localhost
1092+
For example, the following will start a second Fabric CA server on localhost
10861093
listening on port 7055 with a name of "CA2". This represents a completely separate
10871094
root of trust and would be managed by a different member on the blockchain.
10881095

@@ -1125,7 +1132,7 @@ affiliated with **orgs.org1** or **orgs.org1.department1** but can't revoke an
11251132
identity affiliated with **orgs.org2**.
11261133

11271134
The following command disables an identity and revokes all of the certificates
1128-
associated with the identity. All future requests received by the fabric-ca-server
1135+
associated with the identity. All future requests received by the Fabric CA server
11291136
from this identity will be rejected.
11301137

11311138
::
@@ -1172,8 +1179,7 @@ and pass them to the ``revoke`` command to revoke the said certificate as follow
11721179
Enabling TLS
11731180
~~~~~~~~~~~~
11741181

1175-
This section describes in more detail how to configure TLS for a
1176-
fabric-ca-client.
1182+
This section describes in more detail how to configure TLS for a Fabric CA client.
11771183

11781184
The following sections may be configured in the ``fabric-ca-client-config.yaml``.
11791185

@@ -1182,13 +1188,14 @@ The following sections may be configured in the ``fabric-ca-client-config.yaml``
11821188
tls:
11831189
# Enable TLS (default: false)
11841190
enabled: true
1185-
certfiles: root.pem # Comma Separated (e.g. root.pem,root2.pem)
1191+
certfiles:
1192+
- root.pem
11861193
client:
11871194
certfile: tls_client-cert.pem
11881195
keyfile: tls_client-key.pem
11891196

11901197
The **certfiles** option is the set of root certificates trusted by the
1191-
client. This will typically just be the root fabric-ca-server's
1198+
client. This will typically just be the root Fabric CA server's
11921199
certificate found in the server's home directory in the **ca-cert.pem**
11931200
file.
11941201

@@ -1219,7 +1226,7 @@ be used in a production environment
12191226

12201227
1. Place certificates of the certificate authorities (CAs) you trust in the file root.crt in the Postgres data directory
12211228

1222-
2. In postgresql.conf, set "ssl\_ca\_file" to point to the root cert of client (CA cert)
1229+
2. In postgresql.conf, set "ssl\_ca\_file" to point to the root cert of the client (CA cert)
12231230

12241231
3. Set the clientcert parameter to 1 on the appropriate hostssl line(s) in pg\_hba.conf.
12251232

@@ -1242,11 +1249,11 @@ https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html
12421249

12431250
**Basic instructions for configuring SSL on MySQL server:**
12441251

1245-
1. Open or create my.cnf file for the server. Add or un-comment the
1252+
1. Open or create my.cnf file for the server. Add or uncomment the
12461253
lines below in the [mysqld] section. These should point to the key and
12471254
certificates for the server, and the root CA cert.
12481255

1249-
Instructions on creating server and client side certficates:
1256+
Instructions on creating server and client-side certficates:
12501257
http://dev.mysql.com/doc/refman/5.7/en/creating-ssl-files-using-openssl.html
12511258

12521259
[mysqld] ssl-ca=ca-cert.pem ssl-cert=server-cert.pem ssl-key=server-key.pem
@@ -1272,31 +1279,30 @@ https://dev.mysql.com/doc/refman/5.7/en/sql-mode.html
12721279
mysql> GRANT ALL PRIVILEGES ON *.* TO 'ssluser'@'%' IDENTIFIED BY
12731280
'password' REQUIRE SSL; mysql> FLUSH PRIVILEGES;
12741281

1275-
If you want to give a specific ip address from which the user will
1276-
access the server change the '%' to the specific ip address.
1282+
If you want to give a specific IP address from which the user will
1283+
access the server change the '%' to the specific IP address.
12771284

12781285
**MySQL Server - Require Client Certificates**
12791286

12801287
Options for secure connections are similar to those used on the server side.
12811288

12821289
- ssl-ca identifies the Certificate Authority (CA) certificate. This
1283-
option, if used, must specify the same certificate used by the
1284-
server.
1290+
option, if used, must specify the same certificate used by the server.
12851291
- ssl-cert identifies MySQL server's certificate.
12861292
- ssl-key identifies MySQL server's private key.
12871293

12881294
Suppose that you want to connect using an account that has no special
12891295
encryption requirements or was created using a GRANT statement that
12901296
includes the REQUIRE SSL option. As a recommended set of
12911297
secure-connection options, start the MySQL server with at least
1292-
--ssl-cert and --ssl-key, and invoke the fabric-ca-server with
1293-
``db.tls.certfiles`` option set in the Fabric CA server configuration file.
1298+
--ssl-cert and --ssl-key options. Then set the ``db.tls.certfiles`` property
1299+
in the server configuration file and start the Fabric CA server.
12941300

12951301
To require that a client certificate also be specified, create the
12961302
account using the REQUIRE X509 option. Then the client must also specify
12971303
proper client key and certificate files; otherwise, the MySQL server
1298-
will reject the connection. To specify client key and certification files
1299-
for the Fabric CA server, set ``db.tls.certfiles``, ``db.tls.client.certfile``,
1300-
and the ``db.tls.client.keyfile`` configuration properties.
1304+
will reject the connection. To specify client key and certificate files
1305+
for the Fabric CA server, set the ``db.tls.client.certfile``,
1306+
and ``db.tls.client.keyfile`` configuration properties.
13011307

13021308
`Back to Top`_

0 commit comments

Comments
 (0)
Please sign in to comment.