Search code examples
hyperledger-fabrichyperledger-fabric-ca

How to run Fabric-Ca server/client on multiple hosts with tls enabled?


I am running fabric-ca-server on one machine and requesting enroll command from another machine with tls enabled but getting this error

Fabric-ca-server error

Fabric-ca-client error see the highlighted line at the end

can someone please tell me what i am doing wrong or missing? sorry i cannot post pictures.kindly click on the links to see the pictures which shows the error


Solution

  • The error is a common TLS hostname mismatch error where the hostname or IP used in the client request does not match the hostname in the server's TLS certificate.

    Assuming you are relying on the fabric-ca-server autogenerate a TLS certificate, you'll need to specify the --csr.hosts flag when starting the fabric-ca-server, e.g. --csr.hosts <IP address>. In your case, would be 172.20.50.158. (Note that it's advisable to use hostnames rather than IP addresses especially when your host system does not have a static IP address).

    Assuming you get past the above, you will also need to set the trusted root certificates flag (--tls.certfiles) when running the fabric-ca-client commands; you'll need to obtain the root certificate from fabric-ca-server which would be $FABRIC_CA_SERVER_HOME/ca-cert.pem and copy to the machine where you are running the client.