Search code examples
hyperledger-fabrichyperledgerblockchainhyperledger-fabric-ca

Using non-Fabric CA as a parent of Fabric CAs

Is it possible to use a general public CA (like DigiCert) or an arbitrary non-Fabric CA as a parent of intermediate fabric-ca-servers ? The official doc seems to assume that you use only Fabric CAs as parents.

The intention behind this question is to mitigate the centralized nature of a single root CA.

Edit: By "non-Fabric CA" I mean any implementation other than Fabric CA that can act as a CA, e.g. OpenSSL.

non-Fabric CA as a root

Solution

  • Yes, you can use a third-party certificate as a root (RCA) to generate an intermediate certificate (ICA). You can configure Fabric CA to use the ICA to issue peer/orderer certificates.

    Fabric CA User Guide

    If you want the Fabric CA server to use a CA signing certificate and key file which you provide, you must place your files in the location referenced by ca.certfile and ca.keyfile respectively. Both files must be PEM-encoded and must not be encrypted. More specifically, the contents of the CA certificate file must begin with -----BEGIN CERTIFICATE----- and the contents of the key file must begin with -----BEGIN PRIVATE KEY----- and not -----BEGIN ENCRYPTED PRIVATE KEY----.

    Checkout the sample Fabric Config file here. The properties ca.certfile, ca.keyfile and ca.chainfile have to point to the ICA before starting the CA Server.

    Sample Fabric Config File