Fabric多機部署步驟

1 Fabric CA生成

1.1 環境準備和yaml檔案撰寫

CA 鏡像裝載，版本根據需求而定，本次版本是1.4.4，
CA 的yaml檔案撰寫，

需要??yaml檔案有標準格式

//版本

version: '2'

//網路名稱

networks:

rootchain:

//定義服務

services:

//服務名稱

lzsk.ca.chain.com:

//容器名稱

container_name: lzsk.ca.chain.com

//鏡像

image: hyperledger/fabric-ca

//docer容器環境

environment:

//CA 服務端生成證書路徑

- FABRIC_CA_SERVER_HOME=/etc/hyperledger/fabric-ca-server

//CA客戶端生成證書路徑，主要為節點和sdk所用

- FABRIC_CA_CLIENT_HOME=/etc/hyperledger/fabric-ca-client

// CA 的名字

- FABRIC_CA_SERVER_CA_NAME=lzsk.ca.chain.com

# 啟用tls

- FABRIC_CA_SERVER_TLS_ENABLED=true

# 公用名稱

- FABRIC_CA_SERVER_CSR_CN=ca.chain.com

#- FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0

#- FABRIC_CA_SERVER_DEBUG=true

- FABRIC_CA_SERVER_PORT=7054

# -b: 提供注冊用戶的名稱與密碼, 如果沒有使用LDAP, 這個選項為必需.

# 后面兩個引數表示允許洗掉聯盟和用戶

command: sh -c 'fabric-ca-server start -b lzsk_dsp:lzsk_dsp --port 7054 --cfg.affiliations.allowremove --cfg.identities.allowremove'

volumes:

// 宿機和docker 路徑映射

- "./lzsk.ca.chain.com:/etc/hyperledger/fabric-ca-server"

- "./crypto-config:/etc/hyperledger/fabric-ca-client"

//啟動埠

ports:

- 7054:7054

//網路名稱

networks:

- rootchain

啟動步驟2撰寫的yaml 檔案，

命令為：docker-compose -f yaml檔案 up -d

停止docker容器，

在步驟3啟動后會生成相應的持久化檔案，如步驟2中

// 宿機和docker 路徑映射

- "./lzsk.ca.chain.com:/etc/hyperledger/fabric-ca-server"

- "./crypto-config:/etc/hyperledger/fabric-ca-client"

在宿機上就在./lzsk.ca.chain.com下有一個yaml檔案，

進行修改檔案，

version: 1.4.4

# 指定服務的監聽埠

port: 7054

# 跨域資源共享(CORS)

cors:

enabled: false

origins:

- "*"

# 是否啟用DEBUG模式, 輸出更多的除錯資訊上

debug: false

# 可接受的CRL的大小限制(以位元組為單位)(默認值:512000)

# 證書具有一個指定的壽命，但 CA 可通過稱為證書吊銷的程序來縮短這一壽命，

# CA 發布一個證書吊銷串列 (CRL)，列出被認為不能再使用的證書的序列號，

crlsizelimit: 512000

#############################################################################

# 是否在服務端啟用TLS,如果啟用TLS后,進行身份驗證的證書和簽名的私鑰

#############################################################################

tls:

# 是否啟用TLS, 默認不啟用

enabled: true

# TLS證書檔案

certfile:

# TLS密鑰檔案

keyfile:

# 客戶端驗證配置

clientauth:

# 默認不進行身份驗證

type: noclientcert

# 進行客戶端身份驗證時, 信任的證書檔案串列

certfiles:

#############################################################################

# 包括實體的名稱、簽名私鑰檔案、身份驗證證書和證書鏈檔案；這些私鑰和證書

# 檔案會用來作為生成ECert、TCert的根證書

#############################################################################

ca:

# CA服務名稱. 可以支持多個服務

name: ca.chain.com

# 密鑰檔案(默認: ca-key.pem)

keyfile:

# 證書檔案(默認: ca-cert.pem)

certfile:

# 證書鏈檔案(默認: chain-cert.pem)

chainfile:

#############################################################################

# The gencrl REST endpoint is used to generate a CRL that contains revoked

# certificates. This section contains configuration options that are used

# during gencrl request processing.

#############################################################################

crl:

# 為生成的CRL指定過期時間，

# 此屬性指定的小時數將添加到UTC時間

# 產生的時間用于設定CRL的“下一次更新”日期，

expiry: 1h

#############################################################################

# 當fabric-ca-server自身提供用戶的注冊管理時使用, 此情況下需要禁用LDAP功能,

# 否則fabric-ca-server將會把注冊管理資料轉發到LDAP進行查詢

#############################################################################

registry:

# 允許同一個用戶名和密碼進行enrollment的最大次數, -1為無限制, 0為不支持登記

maxenrollments: -1

# 注冊的物體資訊, 可以進行enroll. 只有當LDAP未啟用時起作用

identities:

- name: lzsk_dsp

pass: lzsk_dsp

type: client

affiliation: ""

attrs:

hf.Registrar.Roles: "*"

hf.Registrar.DelegateRoles: "*"

hf.Revoker: true

# 該id是否是一個中間層的CA

hf.IntermediateCA: true

hf.GenCRL: true

hf.Registrar.Attributes: "*"

hf.AffiliationMgr: true

#############################################################################

# 資料庫支持SQLite3、MySQL、Postgres. 默認為SQLite3型別的本地資料庫.

# 如果要配置集群, 則需要選用MySQL或Postgres后端資料庫,

# 并在前端部署負載均衡器(如Nginx或HAProxy)

#############################################################################

db:

type: mysql

datasource: root:tjfae_dsp@tcp(192.168.21.42:3306)/lzsk_ca?parseTime=true

tls:

# 是否啟用TLS來連接到資料庫

enabled: false

# PEM格式的可信根證書檔案串列, 多個用逗號隔開

certfiles:

client:

# PEM格式的客戶端證書檔案

certfile:

# PEM格式的客戶端證書私鑰檔案

keyfile:

#############################################################################

# 配置使用遠端的LDAP來進行注冊管理, 認證enrollment的用戶和密碼,

# 并獲取用戶屬性資訊. 此時, 服務端將按照指定的usrfilter從LDAP獲取對應的用戶,

# 利用其唯一識別名(distinguidhed name)和給定的密碼進行驗證.

# 當LDAP功能啟用時, registry中的配置將被忽略

#############################################################################

ldap:

# 是否啟用LDAP, 默認不啟用

enabled: false

# LDAP的服務地址

url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>

# 客戶端到LDAP服務器的連接的TLS配置

tls:

# PEM格式的LDAP服務器的TLS根證書, 可以為多個, 用逗號隔開

certfiles:

client:

# PEM格式的客戶端證書檔案

certfile:

# PEM格式的客戶端證書私鑰檔案

keyfile:

# Attribute related configuration for mapping from LDAP entries to Fabric CA attributes

attribute:

# 'names' is an array of strings containing the LDAP attribute names which are

# requested from the LDAP server for an LDAP identity's entry

names: ['uid','member']

# The 'converters' section is used to convert an LDAP entry to the value of

# a fabric CA attribute.

# For example, the following converts an LDAP 'uid' attribute

# whose value begins with 'revoker' to a fabric CA attribute

# named "hf.Revoker" with a value of "true" (because the boolean expression

# evaluates to true).

# converters:

# - name: hf.Revoker

# value: attr("uid") =~ "revoker*"

converters:

- name:

value:

# The 'maps' section contains named maps which may be referenced by the 'map'

# function in the 'converters' section to map LDAP responses to arbitrary values.

# For example, assume a user has an LDAP attribute named 'member' which has multiple

# values which are each a distinguished name (i.e. a DN). For simplicity, assume the

# values of the 'member' attribute are 'dn1', 'dn2', and 'dn3'.

# Further assume the following configuration.

# converters:

# - name: hf.Registrar.Roles

# value: map(attr("member"),"groups")

# maps:

# groups:

# - name: dn1

# value: peer

# - name: dn2

# value: client

# The value of the user's 'hf.Registrar.Roles' attribute is then computed to be

# "peer,client,dn3". This is because the value of 'attr("member")' is

# "dn1,dn2,dn3", and the call to 'map' with a 2nd argument of

# "group" replaces "dn1" with "peer" and "dn2" with "client".

maps:

groups:

- name:

value:

#############################################################################

# 組織結構配置

#############################################################################

affiliations:

org1:

- department1

- department2

org2:

- department1

#############################################################################

# 簽發證書相關的配置包括簽名方法、證書超時時間等. fabric-ca-server可以作為

# 用戶證書的簽發CA(默認情況下), 也可以作為根CA來進一步支持其它中間CA

#############################################################################

signing:

# 默認情況下,用于簽署Ecert

default:

# 所簽發證書的KeyUsage extension域

usage:

- digital signature

# 一年

expiry: 8760h

# 不同的簽發配置

profiles:

# 簽署中間層CA證書時的配置模板

ca:

usage:

# 所簽發證書的KeyUsage extension域

- cert sign

- crl sign

expiry: 43800h

caconstraint:

isca: true

# 限制該中間層CA無法進一步簽署中間層CA

maxpathlen: 0

tls:

usage:

- signing

- key encipherment

- server auth

- client auth

- key agreement

expiry: 8760h

###########################################################################

# CA自身證書的申請請求配置. 當CA作為根證書服務時, 將基于請求生成一個

# 自簽名的證書; 當CA作為中間證書服務時, 將請求發送給上層的根證書進行簽署

# 生成ca-cert.pem檔案,是一個自簽署的證書

###########################################################################

csr:

# 公用名稱

cn: ca.chain.com

keyrequest:

algo: ecdsa

size: 256

names:

# 國家

- C: China

# 所在州

ST: "BeiJing"

# 位置或城市

L: BeiJing

# 機構名稱

O: chain

# 機構部門名稱

OU: LZSKMSP

hosts:

- lzsk.ca.chain.com

- localhost

# 配置后會加入到證書的擴展欄位

ca:

# CA根證書默認15年有效

expiry: 131400h

# 允許產生的中間證書的深度

pathlength: 1

###########################################################################

# Each CA can issue both X509 enrollment certificate as well as Idemix

# Credential. This section specifies configuration for the issuer component

# that is responsible for issuing Idemix credentials.

###########################################################################

idemix:

# Specifies pool size for revocation handles. A revocation handle is an unique identifier of an

# Idemix credential. The issuer will create a pool revocation handles of this specified size. When

# a credential is requested, issuer will get handle from the pool and assign it to the credential.

# Issuer will repopulate the pool with new handles when the last handle in the pool is used.

# A revocation handle and credential revocation information (CRI) are used to create non revocation proof

# by the prover to prove to the verifier that her credential is not revoked.

rhpoolsize: 1000

# The Idemix credential issuance is a two step process. First step is to get a nonce from the issuer

# and second step is send credential request that is constructed using the nonce to the isuser to

# request a credential. This configuration property specifies expiration for the nonces. By default is

# nonces expire after 15 seconds. The value is expressed in the time.Duration format (see https://golang.org/pkg/time/#ParseDuration).

nonceexpiration: 15s

# Specifies interval at which expired nonces are removed from datastore. Default value is 15 minutes.

# The value is expressed in the time.Duration format (see https://golang.org/pkg/time/#ParseDuration)

noncesweepinterval: 15m

#############################################################################

# 配置所選擇的加密庫

# msp/keystore中存放的BCCSP (BlockChain Crypto Service Provider)中用到的key

#############################################################################

bccsp:

default: SW

sw:

hash: SHA2

security: 256

filekeystore:

# 存放密鑰檔案的路徑

keystore: msp/keystore

# 自動創建除了默認CA外的多個CA實體, 如ca1、ca2等

cacount:

# 可以指定多個CA組態檔路徑, 每個組態檔會啟動一個CA服務,注意不同組態檔之間需要避免出現沖突(如服務埠、TLS證書等)

cafiles:

#############################################################################

# 當CA作為中間層CA服務時的相關配置. 包括父CA的地址和名稱、登記資訊、TLS配置等.

# 注意: 當intermediate.parentserver.url非空時, 意味著本CA是中間層CA服務,

# 否則為根CA服務

#############################################################################

intermediate:

# 父CA相關資訊

parentserver:

url:

caname:

# 在父CA側的登記資訊

enrollment:

# 證書主機名串列

hosts:

# 簽發所用的profile

profile:

# HSM操作中的標簽資訊

label:

# TLS相關配置

tls:

# 信任的根CA證書

certfiles:

# 客戶端驗證啟用時的相關檔案

client:

certfile:

keyfile:

#############################################################################

# CA configuration section

# Configure the number of incorrect password attempts are allowed for

# identities. By default, the value of 'passwordattempts' is 10, which

# means that 10 incorrect password attempts can be made before an identity get

# locked out.

#############################################################################

cfg:

identities:

passwordattempts: 10

###############################################################################

# Operations section

###############################################################################

operations:

# host and port for the operations server

listenAddress: 127.0.0.1:9443

# TLS configuration for the operations endpoint

tls:

# TLS enabled

enabled: false

# path to PEM encoded server certificate for the operations server

cert:

file:

# path to PEM encoded server key for the operations server

key:

file:

# require client certificate authentication to access all resources

clientAuthRequired: false

# paths to PEM encoded ca certificates to trust for client authentication

clientRootCAs:

files: []

###############################################################################

# Metrics section

###############################################################################

metrics:

# statsd, prometheus, or disabled

provider: disabled

# statsd configuration

statsd:

# network type: tcp or udp

network: udp

# statsd server address

address: 127.0.0.1:8125

# the interval at which locally cached counters and gauges are pushsed

# to statsd; timings are pushed immediately

writeInterval: 10s

# prefix is prepended to all emitted statsd merics

prefix: server

配置完成后進行重新啟動docker 容器，

1.2 在容器內操作生成證書

1.2.1 注冊排序節點、peer節點管理員用戶

# 創建CA管理員檔案夾

1、mkdir -p ${FABRIC_CA_CLIENT_HOME}/tjfae_admin

# 生成fabric-ca admin的憑證

2、export FABRIC_CA_CLIENT_HOME=${FABRIC_CA_CLIENT_HOME}/tjfae_admin// 環境變數設定

fabric-ca-client enroll -u https://tjfae_dsp:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 查看聯盟(使用admin用戶)

3、fabric-ca-client -H ${FABRIC_CA_CLIENT_HOME} affiliation list --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 洗掉默認聯盟

fabric-ca-client -H ${FABRIC_CA_CLIENT_HOME} affiliation remove --force org1 --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

??一定洗掉干凈默認的聯盟

# 創建聯盟

5、fabric-ca-client -H ${FABRIC_CA_CLIENT_HOME} affiliation add com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client -H ${FABRIC_CA_CLIENT_HOME} affiliation add com.chain --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client -H ${FABRIC_CA_CLIENT_HOME} affiliation add com.chain.tjfae --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client -H ${FABRIC_CA_CLIENT_HOME} affiliation add com.chain.tjfadc --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

??紅色為聯盟的名稱，應人而定

# 為每個組織準備msp同時生成節點型別分類組態檔

6、mkdir -p /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/msp

mkdir -p /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/msp

fabric-ca-client getcacert -M /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/msp --caname tjfae.ca.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client getcacert -M /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/msp --caname tjfae.ca.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

復制config.yaml到orderOrganization/chain.com/msp/config.yaml config.yaml內指定的檔案名要和真實目錄下的一致

復制config.yaml到peerOrganizations/tjfae.chain.com/msp/config.yaml config.yaml內指定的檔案名要和真實目錄下的一致

# 注冊各組織管理員

fabric-ca-client enroll -u https://tjfae_dsp:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

??一定要執行這步，否則會報錯

7、fabric-ca-client register -u https://tjfae_dsp:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com --id.name Admin@chain.com --id.secret tjfae_dsp --id.type admin --id.affiliation com.chain --id.attrs '"hf.Registrar.Roles=client,orderer,peer,admin","hf.Registrar.DelegateRoles=client,orderer,peer,admin",hf.Registrar.Attributes=*,hf.GenCRL=true,hf.Revoker=true,hf.AffiliationMgr=true,hf.IntermediateCA=true,role=admin:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client register -u https://tjfae_dsp:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com --id.name Admin@tjfae.chain.com --id.secret tjfae_dsp --id.type admin --id.affiliation com.chain.tjfae --id.attrs '"hf.Registrar.Roles=client,orderer,peer,admin","hf.Registrar.DelegateRoles=client,orderer,peer,admin",hf.Registrar.Attributes=*,hf.GenCRL=true,hf.Revoker=true,hf.AffiliationMgr=true,hf.IntermediateCA=true,role=admin:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 生成各組織管理員憑證

8、mkdir -p /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/users/Admin@chain.com

mkdir -p /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/users/Admin@tjfae.chain.com

fabric-ca-client enroll -u https://Admin@chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -H /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/users/Admin@chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://Admin@tjfae.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -H /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/users/Admin@tjfae.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

cp /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/msp/config.yaml /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/users/Admin@chain.com/msp/config.yaml

cp /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/msp/config.yaml /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/users/Admin@tjfae.chain.com/msp/config.yaml

# 將Admin@chain.com的證書復制到chain.com/msp/admincerts/

9、mkdir /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/msp/admincerts/

mkdir /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/msp/admincerts/

cp /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/users/Admin@chain.com/msp/signcerts/cert.pem /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/msp/admincerts/

cp /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/users/Admin@tjfae.chain.com/msp/signcerts/cert.pem /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/msp/admincerts/

#查看聯盟

fabric-ca-client -H /etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com/users/Admin@chain.com affiliation list --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client -H /etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/users/Admin@tjfae.chain.com affiliation list --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

1.2.2 管理員賬號注冊排序節點普通用戶

# 使用管理員賬號注冊以及生成憑證

17、export FABRIC_CA_CLIENT_HOME=/etc/hyperledger/fabric-ca-client/ordererOrganizations/chain.com

fabric-ca-client register -u https://Admin@chain.com:tjfae_dsp@localhost:7054 -H ${FABRIC_CA_CLIENT_HOME}/users/Admin@chain.com --caname tjfae.ca.chain.com --id.name orderer.chain.com --id.secret tjfae_dsp --id.type orderer --id.affiliation com.chain --id.attrs 'role=orderer:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client register -u https://Admin@chain.com:tjfae_dsp@localhost:7054 -H ${FABRIC_CA_CLIENT_HOME}/users/Admin@chain.com --caname tjfae.ca.chain.com --id.name orderer2.chain.com --id.secret tjfae_dsp --id.type orderer --id.affiliation com.chain --id.attrs 'role=orderer:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client register -u https://Admin@chain.com:tjfae_dsp@localhost:7054 -H ${FABRIC_CA_CLIENT_HOME}/users/Admin@chain.com --caname tjfae.ca.chain.com --id.name orderer3.chain.com --id.secret tjfae_dsp --id.type orderer --id.affiliation com.chain --id.attrs 'role=orderer:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 為剛剛創建的幾個用戶創建各自的檔案夾用于存盤證書檔案

18、mkdir -p ${FABRIC_CA_CLIENT_HOME}/orderers

mkdir -p ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com

mkdir -p ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com

mkdir -p ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com

# 獲取每一個Orderer節點的MSP證書檔案

19、fabric-ca-client enroll -u https://orderer.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -H ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com --csr.hosts orderer.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://orderer2.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -H ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com --csr.hosts orderer2.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://orderer3.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -H ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com --csr.hosts orderer3.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 獲取每一個Orderer節點的TLS證書檔案

20、fabric-ca-client enroll -u https://orderer.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls --enrollment.profile tls --csr.hosts orderer.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://orderer2.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls --enrollment.profile tls --csr.hosts orderer2.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://orderer3.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls --enrollment.profile tls --csr.hosts orderer3.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 將之前生成的節點型別分類組態檔拷貝到每一個節點的MSP檔案夾

cp ${FABRIC_CA_CLIENT_HOME}/msp/config.yaml ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/msp/config.yaml

cp ${FABRIC_CA_CLIENT_HOME}/msp/config.yaml ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/msp/config.yaml

cp ${FABRIC_CA_CLIENT_HOME}/msp/config.yaml ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/msp/config.yaml

# 為每一個節點的TLS證書以及秘鑰檔案修改名字，方便之后的使用

21、cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/ca.crt

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/signcerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/server.crt

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/keystore/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/server.key

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/ca.crt

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/signcerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/server.crt

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/keystore/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/server.key

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/ca.crt

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/signcerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/server.crt

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/keystore/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/server.key

# 在MSP檔案夾內創建tlscacerts檔案夾，并將TLS檔案拷貝過去

22、mkdir ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/msp/tlscacerts

mkdir ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/msp/tlscacerts

mkdir ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/msp/tlscacerts

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem

# 復制TLS根證書

23、mkdir -p ${FABRIC_CA_CLIENT_HOME}/msp/tlscacerts

cp ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/msp/tlscacerts/tlsca.chain.com-cert.pem

# 將Admin@chain.com的證書復制到/chain.com/orderers/orderer.chain.com/msp/admincerts

24、mkdir ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/msp/admincerts

mkdir ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/msp/admincerts

mkdir ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/msp/admincerts

cp ${FABRIC_CA_CLIENT_HOME}/users/Admin@chain.com/msp/signcerts/cert.pem ${FABRIC_CA_CLIENT_HOME}/orderers/orderer.chain.com/msp/admincerts

cp ${FABRIC_CA_CLIENT_HOME}/users/Admin@chain.com/msp/signcerts/cert.pem ${FABRIC_CA_CLIENT_HOME}/orderers/orderer2.chain.com/msp/admincerts

cp ${FABRIC_CA_CLIENT_HOME}/users/Admin@chain.com/msp/signcerts/cert.pem ${FABRIC_CA_CLIENT_HOME}/orderers/orderer3.chain.com/msp/admincerts

1.2.3 管理員賬號注冊peer節點普通用戶

# 創建子檔案夾用于存盤證書檔案

25、export FABRIC_CA_CLIENT_HOME=/etc/hyperledger/fabric-ca-client/peerOrganizations/tjfae.chain.com/

# 注冊四個用戶:peer0,peer1,user1,tjfaeAdmin，其中peer是必需的，user1用于測驗的，Admin@tjfae.chain.com為Admin用戶，安裝和實體化鏈碼需要Admin用戶的證書

26、fabric-ca-client register -u https://Admin@tjfae.chain.com:tjfae_dsp@localhost:7054 -H ${FABRIC_CA_CLIENT_HOME}/users/Admin@tjfae.chain.com --caname tjfae.ca.chain.com --id.name tjfae_peer0 --id.secret tjfae_dsp --id.type peer --id.affiliation com.chain.tjfae --id.attrs '"hf.Registrar.Roles=peer",role=peer:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client register -u https://Admin@tjfae.chain.com:tjfae_dsp@localhost:7054 -H ${FABRIC_CA_CLIENT_HOME}/users/Admin@tjfae.chain.com --caname tjfae.ca.chain.com --id.name tjfae_peer1 --id.secret tjfae_dsp --id.type peer --id.affiliation com.chain.tjfae --id.attrs '"hf.Registrar.Roles=peer",role=peer:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client register -u https://Admin@tjfae.chain.com:tjfae_dsp@localhost:7054 -H ${FABRIC_CA_CLIENT_HOME}/users/Admin@tjfae.chain.com --caname tjfae.ca.chain.com --id.name User1@tjfae.chain.com --id.secret tjfae_dsp --id.type client --id.affiliation com.chain.tjfae --id.attrs '"hf.Registrar.Roles=client",role=client:ecert' --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 為剛剛創建的幾個用戶創建各自的檔案夾用于存盤證書檔案

26、mkdir -p ${FABRIC_CA_CLIENT_HOME}/peers

mkdir -p ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com

mkdir -p ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com

# MSP檔案

27、fabric-ca-client enroll -u https://tjfae_peer0:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/msp --csr.hosts peer0.tjfae.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://tjfae_peer1:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/msp --csr.hosts peer1.tjfae.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# TLS證書

28、fabric-ca-client enroll -u https://tjfae_peer0:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls --enrollment.profile tls --csr.hosts peer0.tjfae.chain.com --csr.hosts peer0.tjfae.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

fabric-ca-client enroll -u https://tjfae_peer1:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls --enrollment.profile tls --csr.hosts peer1.tjfae.chain.com --csr.hosts peer1.tjfae.chain.com --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 拷貝節點分類組態檔

29、cp ${FABRIC_CA_CLIENT_HOME}/msp/config.yaml ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/msp/config.yaml

cp ${FABRIC_CA_CLIENT_HOME}/msp/config.yaml ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/msp/config.yaml

# 修改證書以及秘鑰檔案，方便之后使用

30、cp ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/ca.crt

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/signcerts/* ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/server.crt

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/keystore/* ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/server.key

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls/ca.crt

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls/signcerts/* ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls/server.crt

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls/keystore/* ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/tls/server.key

# 復制TLS相關證書

31、mkdir ${FABRIC_CA_CLIENT_HOME}/msp/tlscacerts

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/msp/tlscacerts/ca.crt

mkdir ${FABRIC_CA_CLIENT_HOME}/tlsca

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/tls/tlscacerts/* ${FABRIC_CA_CLIENT_HOME}/tlsca/tlsca.tjfae.chain.com-cert.pem

mkdir ${FABRIC_CA_CLIENT_HOME}/ca

cp ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/msp/cacerts/* ${FABRIC_CA_CLIENT_HOME}/ca/ca.tjfae.chain.com-cert.pem

# 獲取user用戶證書檔案

32、mkdir -p ${FABRIC_CA_CLIENT_HOME}/users/User1@tjfae.chain.com

# 獲取證書檔案

48、fabric-ca-client enroll -u https://User1@tjfae.chain.com:tjfae_dsp@localhost:7054 --caname tjfae.ca.chain.com -M ${FABRIC_CA_CLIENT_HOME}/users/User1@tjfae.chain.com/msp --tls.certfiles ${FABRIC_CA_SERVER_HOME}/tls-cert.pem

# 將Admin@tjfae.chain.com的證書復制到${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/msp/admincerts

24、mkdir ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/msp/admincerts

mkdir ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/msp/admincerts

mkdir ${FABRIC_CA_CLIENT_HOME}/users/User1@tjfae.chain.com/msp/admincerts

cp ${FABRIC_CA_CLIENT_HOME}/users/Admin@tjfae.chain.com/msp/signcerts/cert.pem ${FABRIC_CA_CLIENT_HOME}/peers/peer0.tjfae.chain.com/msp/admincerts

cp ${FABRIC_CA_CLIENT_HOME}/users/Admin@tjfae.chain.com/msp/signcerts/cert.pem ${FABRIC_CA_CLIENT_HOME}/peers/peer1.tjfae.chain.com/msp/admincerts

cp ${FABRIC_CA_CLIENT_HOME}/users/Admin@tjfae.chain.com/msp/signcerts/cert.pem ${FABRIC_CA_CLIENT_HOME}/users/User1@tjfae.chain.com/msp/admincerts

1.2.4生成證書完成操作

生成完證書完成后，客戶端證書拷貝到各個節點路徑下，

2 節點組態檔修改

version: '2'

# 對網路的宣告,即該yaml組態檔中所有服務所涉及到的網路

networks:

rootchain:

# 網路使用的驅動型別，默認為bridge

driver: bridge

services:

peer0.lzsk1.chain.com:

container_name: peer0.lzsk1.chain.com

hostname: peer0.lzsk1.chain.com

image: hyperledger/fabric-peer:latest

environment:

- TZ=Asia/Shanghai

- CORE_LEDGER_STATE_STATEDATABASE=CouchDB

//couchDB埠

-CORE_LEDGER_STATE_COUCHDBCONFIG_COUCHDBADDRESS=couchdb1:6984

//couchDB用戶設定

- CORE_LEDGER_STATE_COUCHDBCONFIG_USERNAME=lzsk_dsp

//couchDB 密碼設定

- CORE_LEDGER_STATE_COUCHDBCONFIG_PASSWORD=lzsk_dsp

- CORE_PEER_ID=peer0.lzsk1.chain.com

- CORE_PEER_ADDRESS=peer0.lzsk1.chain.com:8051

# 設定或讀取peer節點的監聽地址，默認情況下Peer節點在所有地址上監聽請求

- CORE_PEER_LISTENADDRESS=0.0.0.0:8051

# 鏈碼連接該Peer節點的地址，

- CORE_PEER_CHAINCODEADDRESS=peer0.lzsk1.chain.com:8052

# Peer節點監聽鏈碼連接請求的地址，如果未設定該引數，將自動選擇節點地址的7052埠

- CORE_PEER_CHAINCODELISTENADDRESS=peer0.lzsk1.chain.com:8052

# 向機構外的節點發布的訪問端節點，如果未設定該引數，節點將不為其他機構所知，

- CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.lzsk1.chain.com:8051

# 設定初始化gossip的引導節點串列，節點啟動時將連接這些引導節點，

# 這里列出的引導節點必須與當前節點屬于同一機構，否則連接將被拒絕，

- CORE_PEER_GOSSIP_BOOTSTRAP=peer0.lzsk1.chain.com:8051

# 本地MSP的標識ID

# 部署人員需要修改localMspId的值！尤其重要的一點是，

# localMspID的值需要匹配該節點所在通道中的某個MSP，

# 否則該節點的訊息將被其他節點視為無效

- CORE_PEER_LOCALMSPID=Lzsk1MSP

- CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock

- FABRIC_LOGGING_SPEC=INFO

- CORE_LEDGER_HISTORY_ENABLEHISTORYDATABASE=true

# 節點是否使用動態演算法選出主導節點，該主導節點將連接

# 排序服務并使用分發協議從排序服務拉取賬本區塊，

# 對大型網路建議啟用主導節點選舉，

- CORE_PEER_GOSSIP_USELEADERELECTION=true

# 是否靜態指定機構的主導節點，該節點將負責維持與排序節點的

# 連接并向機構中的其他節點分發區塊，

- CORE_PEER_GOSSIP_ORGLEADER=false

- CORE_PEER_PROFILE_ENABLED=true

# 啟用對服務端的TLS身份驗證，

- CORE_PEER_TLS_ENABLED=true

# Peer節點的X.509證書檔案路徑，

- CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt

# Peer節點的私鑰檔案路徑，

- CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key

# Peer節點證書的驗證鏈根證書檔案路徑

- CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt

working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer

command: peer node start

volumes:

- /var/run/:/host/var/run/

- ./crypto-config/peerOrganizations/lzsk1.chain.com/peers/peer0.lzsk1.chain.com/msp:/etc/hyperledger/fabric/msp

- ./crypto-config/peerOrganizations/lzsk1.chain.com/peers/peer0.lzsk1.chain.com/tls:/etc/hyperledger/fabric/tls

- /root/go/src/github.com/hyperledger/fabric-samples/lzsk/peer0.lzsk1.chain.com:/var/hyperledger/production

ports:

- "8051:8051"

- "8052:8052"

- "8053:8053"

depends_on:

- couchdb1

networks:

- rootchain

extra_hosts:

#- "orderer117.chain.com:192.168.133.117"

- "orderer.chain.com:192.168.21.42"

- "couchdb1:192.168.21.42"

container_name: couchdb1

image: hyperledger/fabric-couchdb:latest

environment:

- TZ=Asia/Shanghai

- COUCHDB_USER=lzsk_dsp

- COUCHDB_PASSWORD=lzsk_dsp

volumes:

- /root/go/src/github.com/hyperledger/fabric-samples/lzsk/couchdb1:/opt/couchdb/data

ports:

- "6984:5984"

networks:

- rootchain

cli1:

container_name: cli1

image: hyperledger/fabric-tools:latest

tty: true

environment:

- TZ=Asia/Shanghai

- GOPATH=/opt/gopath

- CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock

- FABRIC_LOGGING_SPEC=INFO

- CORE_PEER_ID=cli

- CORE_PEER_ADDRESS=peer0.lzsk1.chain.com:8051

- CORE_PEER_LOCALMSPID=Lzsk1MSP

- CORE_PEER_TLS_ENABLED=true

- CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/lzsk1.chain.com/peers/peer0.lzsk1.chain.com/tls/server.crt

- CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/lzsk1.chain.com/peers/peer0.lzsk1.chain.com/tls/server.key

- CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/lzsk1.chain.com/peers/peer0.lzsk1.chain.com/tls/ca.crt

- CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/lzsk1.chain.com/users/Admin@lzsk1.chain.com/msp

working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer

command: /bin/bash

volumes:

- /var/run/:/host/var/run/

- ./chaincode:/opt/gopath/src/github.com/chaincode

- ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/

- ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts

depends_on:

- peer0.lzsk1.chain.com

networks:

- rootchain

extra_hosts:

#- "orderer117.chain.com:192.168.133.117"

- "orderer.chain.com:192.168.21.42"

- "peer0.lzsk1.chain.com:192.168.21.42"

修改完成后，docker啟動節點.

命令為：docker-compose -f yaml檔案 up -d

2.1 生成創世區塊和通道

# 首先進入區塊鏈檔案夾例如：cd /opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/

# 告訴configtxgen從哪里尋找configtx.yaml檔案

1、export FABRIC_CFG_PATH=$PWD

# Raft方式:生成系統通道創世區塊genesis.block

2、../bin/configtxgen -profile SampleMultiNodeEtcdRaft -channelID mychannel -outputBlock ./channel-artifacts/genesis.block

# 創建通道配置事務

3 ../bin/configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/mychannel.tx -channelID rootchain

# 創建更新組織TjfaeMSP、TjfadcMSP在該通道上的錨節點的事務

4、../bin/configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ./channel-artifacts/TjfaeMSPanchors.tx -channelID rootchain -asOrg TjfaeMSP

../bin/configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ./channel-artifacts/TjfadcMSPanchors.tx -channelID rootchain -asOrg TjfadcMSP

# 發送生成的檔案到另外機器上

5、

Scp -r /opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/channel-artifacts root@192.168.133.112:/opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/

scp -r /opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/channel-artifacts root@192.168.133.119:/opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/

2.2 啟動各節點

# peer客戶端cli內執行：創建通道

1、peer channel create -o orderer.chain.com:7050 -c rootchain -f ./channel-artifacts/mychannel.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/chain.com/orderers/orderer.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem

# peer客戶端cli內執行：加入通道(其他機器加入通道需先執行9-11步驟)

2、peer channel join -b rootchain.block

# 退出容器：從容器中拷貝生成的mychannel.block檔案到宿主機

3、docker cp cli:/opt/gopath/src/github.com/hyperledger/fabric/peer/rootchain.block /opt/

# 發送mychannel.block檔案到其他機器

4、scp -r /opt/rootchain.block root@192.168.133.113:/opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/channel-artifacts

# 從宿主機拷貝mychannel.block檔案到容器內，使用mychannel.block檔案加入通道

5、docker cp /opt/gowork/src/github.com/hyperledger/fabric-samples/rootchain/channel-artifacts/rootchain.block cli:/opt/gopath/src/github.com/hyperledger/fabric/peer

docker cp /opt/rootchain.block cli:/opt/gopath/src/github.com/hyperledger/fabric/peer

??各個幾點都需要拷貝mychannel.block 拷貝到啟動容器內

2.3 安裝鏈碼

# peer客戶端cli內執行：更新錨節點(每個組織都需要更新錨節點,各組織進入自己的peer客戶端內執行)

6、peer channel update -o orderer.chain.com:7050 -c rootchain -f ./channel-artifacts/TjfaeMSPanchors.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/chain.com/orderers/orderer.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem

peer channel update -o orderer2.chain.com:7050 -c rootchain -f ./channel-artifacts/TjfadcMSPanchors.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/chain.com/orderers/orderer.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem

# 環境變數

CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/tjfae.chain.com/users/Admin@tjfae.chain.com/msp

CORE_PEER_ADDRESS=peer0.tjfae.chain.com:7051

CORE_PEER_LOCALMSPID="TjfaeMSP"CORE_PEER_LOCALMSPID="TjfaeMSP"

CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/tjfae.chain.com/peers/peer0.tjfae.chain.com/tls/ca.crt

# 在peer節點上安裝鏈碼（同一組織多個節點切換環境變數依次安裝，只需在背書節點安裝鏈碼，各組織進入自己的peer客戶端內執行）

7、peer chaincode install -n benefit -v 1.0 -p ../../../chaincode/benefit/ -l java

# 初始化鏈碼（只需在其中一個背書節點執行即可，后續執行交易，其他節點收到交易請求后，會自動安裝鏈碼）

8、peer chaincode instantiate -o orderer.chain.com:7050 --tls true --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/chain.com/orderers/orderer.chain.com/msp/tlscacerts/tlsca.chain.com-cert.pem -C rootchain -n benefit -v 1.0 -c '{"Args":["init"]}' -P "AND ('TjfadcMSP.peer','TjfaeMSP.peer')"

peer chaincode query -C rootchain -n benefit -c '{"Args":["create","{\"name\":\"test\"}","10"]}'

3 常見問題分析

3.1 Mysql問題

Mysql ERROR 1067: Invalid default value for 欄位

解決方案：

vi /etc/my.cnf //添加以下配置
sql_mode=ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION

ERROR 1067 (42000): Invalid default value for ' '

解決方案：

3.2 鏡像版本問題

3.3 容器報的錯

iptabes: No chain/target/match by that name. (exit status 1)

解決方案：iptables: No chain/target/match by that name. (exit status 1)

connect error: No route to host(errno:113)

解決方案：方法一：關閉防火墻

centos關閉防火墻的操作為

systemctl stop firewalld

方法二：在防火墻上開發指定埠

firewall-cmd --zone=public --add-port=2181/tcp --perm anent

firewall-cmd --reload

Get https://registry-1.docker.io/v2/: dia tcp: lookup registry-1.docker.io: no such host

解決方案：

編輯/etc/resolv.conf 檔案，增加一行dns地址，例如：nameserver 8.8.4.4

3.4 瀏覽器報錯

sudo: psq：找不到命令

轉載請註明出處，本文鏈接：https://www.uj5u.com/qukuanlian/224334.html

標籤：區塊鏈

上一篇：肖風在第五屆區塊鏈全球峰會的閉幕演講全文：由 Libra 引起的思考

下一篇：Ubuntu 18.04 ETH同步節點搭建

fabric 多機部署

Fabric多機部署步驟

1 Fabric CA生成

1.1 環境準備和yaml檔案撰寫

1.2 在容器內操作生成證書

2 節點組態檔修改

2.1 生成創世區塊和通道

2.3 安裝鏈碼

3 常見問題分析

3.1 Mysql問題

3.2 鏡像版本問題

解決方案：iptables: No chain/target/match by that name. (exit status 1)

解決方案：方法一：關閉防火墻

centos關閉防火墻的操作為

systemctl stop firewalld

方法二： 在防火墻上開發指定埠

firewall-cmd --zone=public --add-port=2181/tcp --perm anent

firewall-cmd --reload

方法二：在防火墻上開發指定埠