Search code examples
hyperledger-fabrichyperledgerhyperledger-fabric-ca

Why previous ecert and keys are still valid after restarting fabric network?


Following fabcar sample tutorial (Writing Your First Application) I've registered and enrolled 'user1' user by admin ecert. So keys and eCert of 'user1' was saved in 'hfc-key-store' subdirectory. Using 'user1' identity material I read data from ledger using query.js script.

After that, I want to launch the network again, so kill all docker containers, clear docker images, networks and volumes. But identity materials ('hfc-key-store') were not destroyed. After relaunching the network I try to query ledger data with previous 'user1' identity material, and it works fine. I can't understand why old 'user1' ecert is still valid after restarting network? What fabric component should check if ecert is enrolled by fabric-ca? After relaunching I don't enroll admin for fabric-ca, so 'user1' is also not registered.

Thanks.


Solution

  • The fabcar sample network config used pre-generated certificates and key material that means the root cert of fabric-ca remains the same, so previous 'user1' identity material is still valid. If you regenerate root cert, access with previous certs will be denied.