►
From YouTube: Insight Into a Production-Ready Hyperledger Fabric Certificate Autho... Noah Elia Schär & Aaron Beer
Description
Insight Into a Production-Ready Hyperledger Fabric Certificate Authority - Noah Elia Schär & Aaron Beer, PostFinance Inc.
In a private, permissioned blockchain, all participants must be identified. Hyperledger Fabric uses a Public Key Infrastructure (PKI) to manage these identities. For testing purposes, the Cryptogen tool can be used to initially create the crypto material. However, for a production network, its use is strongly discouraged. One important reason is that the entire lifecycle of the crypto material cannot be managed. Due to the limited documentation, the barrier to entry is high to build a production-ready PKI in Hyperledger Fabric. We at PostFinance TechLab have taken the leap and replaced Cryptogen with Hyperledger Fabric CA. In our presentation, we will explain the biggest differences and most importantly the benefits of Fabric CA. In addition, we will explain many of the lessons we learned during the trial & error implementation process with concrete examples and a demo. We break down the problem of moving to Fabric CA into individual steps and show how we built a state-of-the-art PKI that interoperates with the Hyperledger Fabric blockchain. We plan to make our learnings available for the official Hyperledger Fabric documentation.
Sessions Details & Slides (if available): https://sched.co/14H5v
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)
B
A
A
A
A
Continuing
with
asymmetic
cryptography,
also
called
public
key
cryptography?
This
term
consists
of
a
key
pair
which
consists
the
public
and
the
private
key.
This
keeper
can
be
used
for
encryption,
which
we
will
not
go
further
into
in
this
presentation,
but
very
important
digital
signatures,
and
there
we
have
design.
We
do
this
with
the
private
key
of
the
key
pair,
and
this
can
only
do
the
admin
or
the
owner
a
better
set
of
the
key
pair
and
the
verify
procedure
of
digital
signature
can
be
done
by
every
participant
of
the
network
with
the
public
key.
A
Now
it
comes
together
in
this
public
key
infrastructure
term
also
called
pki.
For
short,
this
is
like
the
assignment
of
an
identity
to
a
public
key
and
the
identification
is
done
by
trustworthy,
Authority,
which
issues
digital
certificates.
So
we
call
this
Authority
the
certificate
Authority,
the
ca,
the
digital
certificates
contain
information
about
the
identity,
attributes
the
public
key
and
the
signature
of
the
ca
by
itu.
There
is
a
standard
set
which
is
called
x.509,
which
we
use
in
our
solution.
A
And
now
the
implementation
of
hyper
electric
Fabric
and
there's
the
hypele
fabric
Network,
which
consists
typically
of
organizations
which
are
companies
participating
in
the
network
and
they
belong.
And
there
are
identities
which
belong
to
those
organizations
and
they
can
be
type
of
peers,
orders,
clients
and
admins.
A
A
And
those
two
combined
like
the
pki
version
in
the
implementation
of
hyper
later,
it's
the
hypoelectric
fabric
CA,
which
handles
the
whole
life
cycle
of
identities
and
crypto
material,
so
issuing
with
registering
and
enrolling
identities
and
also
renewing
and
revoking
of
certificates
is
included,
and
there
is
the
global
MSP.
Msp
stands
for
membership
service
provider,
and
this
is
a
directory
structure
which
is
built,
and
the
name
is
very
misleading,
because
this
MSP
doesn't
service
or
provides
anything
actively,
and
it's
really
only
folder
and
certificate
structure.
A
A
And
now
some
definition
to
to
improve
the
understanding
of
the
rest
of
the
presentation.
So
when
we
talk
about
an
intermediate
CA,
we
mean
every
CA
except
the
root
CAA.
When
we're
talking
about
an
operative
CA,
we
mean
an
intermediate
CA
on
the
lowest
layer
and
this
CA
manages
the
end
and
the
decrypt
material.
B
Yes,
so
now,
let's
Dive
Right
In
and
see
how
we
got
started
with
hyperledger
fabric
certificate
Authority.
We
started
off
with
a
simple
fabric,
blockchain
network,
with
which
we
wanted
to
go
into
production
mode.
Now
we
had
two
peers
and
three
orders
running,
and
these
ran
on
kubernetes
and
communicated
with
mutual
TLS
with
each
other.
The
cryptographic
material
was
generated
by
cryptogen.
Now
you
may
ask
what
is
cryptogen
well.
B
Cryptogen
is
a
tool
developed
by
hyperledger
fabric
to
generate
initial
key
material
to
then
start
a
hyperledger
fabric
Network
the
tool
consists
of
a
binary
and
a
config
file.
You
see
the
config
file
on
the
right
on
the
screen.
This
is
a
very
simple
config
file
in
which
we
can
configure
things
like
for
how
many
peers,
or
how
many
users
we
want
cryptographic
material
and
that's
where
our
problem
arised.
Now
we
wanted
to
go
into
production
and
in
the
read
the
docs
it
says
for
cryptogen.
B
It
would
normally
not
be
used
in
the
operation
of
a
production
Network
and
the
tool
is
provided
for
development
and
testing.
Only
so
we
wanted
to
go
into
production,
but
had
crypto
channel
news.
Big
problem
now
crypto
Chen
is
like
a
one-way
ticket.
It
can
easily
issue
crypto
material,
but
there
are
many
other
features
that
are
necessary
for
a
production
Network
that
it
can't
provide.
A
A
So
now
crypto
chain
doesn't
meet
our
requirements,
and
so
we
built
this
diagram
to
have
a
closer
look.
What
our
solution
has
to
provide.
So
what
is
this
in
detail
now
very
important
is
that
the
identity
is
connected
with
the
certificate
and
because
of
cryptogen
we
only
issue
certificates
itself,
there's
no
identity,
part
and
also
the
rest
of
the
whole
life
cycle
of
certificates
and
identities
has
to
be
covered.
A
So
we
search
for
products
that
fulfill
this
criteria
and
we
found
out
that
fabric
has
its
own
CA
solution,
which
is
called
the
fabric
certificate
Authority,
which
manages
the
Network's
identities
and
can
issue
revoke
and
renew
crypto
material.
So
there
is
also
there
are
also
two
binaries
that
come
with
fabric
CA.
A
Now,
if
we
compare
those
two
solutions,
cryptogen
and
fabric
CA,
we
can
see
that
the
the
features
included
in
fabric
CA
are
are
like.
We
expect
that
in
a
product
the
production
network,
but
this
we
already
thought
that
this
would
require
a
more
knowledge
and
more
work
to
implement
this
solution
due
to
the
higher
complexity.
A
A
We
found
several
options
regarding
the
hierarchy
in
the
read
the
docs
and
we
discussed
them
as
a
team
and
I
will
present
to
them
now.
The
first
one
is
like
how
we
built
the
layers
of
the
hierarchy
as
a
first
option.
We
saw
the
possibility
to
just
run
a
fabric
CA
as
a
route
and
at
the
same
time
as
an
operative
CA.
So
every
end
entity,
Crypt
material,
is
issued
by
the
ca.
A
This
is
quite
similar
to
the
second
one,
but
there
are
one
or
multiple
layers
in
between
the
routes
a
and
the
operative,
and
with
this
we
can
extend
like
the
chain
of
trust,
but
our
team
committed
for
the
second
option,
because
it's
like
the
the
multi-level
architecture
or
hierarchy.
We
wanted
to
build
to
generate
a
chain
of
trust
and,
in
case
of
compromised
net
to
a
crypt
material.
A
We
would
handle
this
way
faster
and
didn't
have
to
have
to
exchange
the
whole
crypto
material,
and
this
is
not
that
complex
compared
to
the
third
option,
which
is
similar,
but
this
is
like
would
be
an
Overkill.
The
third
one,
then,
by
separating
TLS
and
signing
CA,
was
also
another
decision.
We
see
this
in
option
two.
A
We
would
build
two
operatives
CA
one
for
TLS
and
one
for
the
designing
certificates
and
the
other
option
would
just
be
a
provide
those
two
different
certificates
in
the
same
operative
CA
and
again,
we
voted
as
a
team
for
the
second
option,
because
with
this
we
can
build
a
separate
chain
of
trust
for
TLS
and
signing
and
handled
the
certificate
types
independent.
So
in
case
of
using
an
HSM,
a
Hardware
security
module.
A
A
A
A
Then
we
enroll
the
identity
for
the
signing
CA
server.
We
register
the
identity
first,
of
course,
so
that
we
can
enroll
it
on
this
tlsca
and
do
we
get
from
this
tlsca
server
the
TLs
a
certificate
with
the
belonging,
a
private
key?
So
when
we
have
this,
we
can
we
have
to
configure,
of
course,
the
TLs
section
also,
and
then
we
can
finally
launch
the
signing
CA
server.
A
Then
underneath
the
the
ca
Crypt
material
containing
the
chain
file
that
digital
certificate
and
the
private
key
for
every
operative
CA,
then
we
continue
by
configuring,
the
TLs
Cas,
also,
of
course,
for
the
peer
and
order
like
we
have
chosen
in
our
decisions
there.
First,
we
Mount
the
openssl
ca,
Crypt
material
and
configure
it.
A
A
Then
we
continue
with
the
signing
cas
also
for
peer
and
Order
their
first.
We
also
Mount
the
open,
sslca
Crypt
material
register,
an
identity
for
the
assigning
CA
on
the
tlsca
and
then
roll
it.
So
we
get
the
TLs
crypto
material
and
last
but
not
least,
we
are
ready
to
issue
identities
and
they
should
belonging
certificates
to
the
rest
of
our
fabric.
Network.
B
Yes
and
how
that
works,
let's
look
at
it
step
by
step.
First
of
all,
we
have
a
fabric
tools
container,
that's
a
simple
container
which
contains
the
fabric,
CA,
client,
binary,
and
with
this
container
we
communicate
to
all
of
our
CA
servers,
and
this
container
also
includes
our
Global
MSP
and
are
all
of
our
local
msps
included
in
the
global
MSP.
Of
course,
you
see
here
two
examples
of
local
msps.
B
There
will
be
all
the
others
as
well
now
it
is
very
important
to
mention
that
we
have
one
single
database
for
both
TLS
and
signing
CA.
That
means
we
generate
a
crypto
material
for
the
same
identity
for
both
TLS
and
signing,
which
also
means
that
it,
it
is
much
easier
to
manage
for
us
in
case
of
compromised
crypto
material.
B
Now,
let's
look
at
the
step
of
issuing
end
entity,
crypto
material
step
by
step.
First
of
all,
we
have
to
register
an
identity.
We
take
an
asexa
as
an
example
appear,
so
we
register
a
peer
Identity
On,
which
CA
we
do.
This
doesn't
matter
because
once
again,
the
cas
share
the
same
database.
So
we
can
do
this
on
the
tlsca.
For
example,
then,
as
the
next
step,
we
enroll
this
gen,
this
created
identity
on
the
tlsca.
B
B
Yes,
I
was
in
enrolling
sorry,
so
the
tlsca
doesn't.
It
already
has
persisted
its
identity
in
the
database.
So
now
it
persists
the
crypto
material
from
this
identity
and
in
the
fabric
tools
container.
We
get
a
copy
of
this
generated,
crypto
material.
As
the
next
step.
We
enroll
the
exact
same
identity
on
the
signing
CA.
The
signing
CA
persists
that
crypto
material
that
was
generated
in
the
database
and
once
again
in
the
fabric
tools
container,
we
get
a
copy
of
this
generated
crypto
material.
B
Now
it
is
important
to
mention
that
we
have
the
TLs
crypto
material
saved
on
the
slash
TLS
and
designing
crypto
material
saved
on
the
slash
MSP.
The
next
step
is
to
organize
and
rename
all
of
our
files
contained
in
this
local
MSP.
How
we
do
this
in
detail,
I'll,
explain,
I
I'll,
explain
later
so
now
we
are
ready
to
configure
our
peer
to
mount
this
local
MSP,
which
is
ready
and
when
it
is
mounted
the
pier
can
be
launched.
B
B
B
Now,
when
we
execute
this
command,
we
get
the
following
file
structure.
We
have
the
sign,
search
folder
with
the
generated
certificate.
We
have
the
key
store
folder
with
the
corresponding
private
key.
Then
we
have
the
intermediate
search
folder,
which
contains
the
chain
file
and
the
ca
search
folder,
which
contains
the
ca
root
certificate.
B
Now
we
do
some
renaming
to
make
things
easier
for
us.
First
of
all,
we
rename
the
private
key
to
a
name
which
isn't
that
cryptic
anymore,
we
add
a
minus
chain
to
the
name
of
the
chain
file.
So
we
know
it
is
a
chain
file
and
we
we
remove
the
ports
from
the
file
names
so
because
we
think
they
are
unnecessary
unnecessary
for
our
case
at
the
right,
you
see
the
the
final
local
MSP
for
the
signing
crypto
material.
B
First
of
all,
we
noticed
that
fabric
CA
has
a
configuration
hierarchy
for
almost
all
config
properties.
We
can
Define
them
in
three
ways
as
an
example,
when
we
want
to
define
the
ca
certificate
for
the
ca
server,
we
can
do
that,
first
of
all,
by
providing
a
flag
in
the
fabric,
CA
server
start
command.
B
We
can
also
do
it
by
setting
an
environment
variable
in
the
fabric
CA
server
container,
or
we
can
Define
it
in
the
config
file
of
the
fabric
CA
server,
and
now
there
is
the
hierarchy
that
is
important
to
do,
to
detect
the
flags,
overwrite
environment
variables
and
those
override
the
config
files.
So
when
we
specify
a
CA
certificate
when
starting
the
server
in
the
with
a
flag,
all
all
the
other
prop
the
same
property
in
the
other
ways
to
configure
it
are
overwritten.
B
B
B
Now
a
simple
example:
when
we
have
a
fabric,
CA
hierarchy
with
two
layers,
a
root
and
an
operative
layer,
we
would
choose
the
value
of
1
in
the
root
layer
and
the
value
of
0
in
the
operative
layer
and
in
our
example,
because
we
have
no
fabric
CA
server
as
the
root.
We
generate
the
root
crypto
material
with
open
SSL,
and
we
only
have
one
layer
of
operative
Cas.
We
dare
choose
the
value
of
0
for
for
the
property,
Max
path,
length.
B
Now
another
attribute
in
the
same
signing
section:
we
have
these
different
profiles.
We
can
enroll
certificates
with.
We
see
here
the
default
profile
and
the
ca
profile,
and
there
is
this
attribute
called
SCA,
and
this
attribute
defines
if
the
profile
and
enrolls
a
CA
certificate
in
the
profile
CA
there
is
this
attribute
default
set
to
True,
which
means,
when
enrolling
an
identity
with
the
ca
profile,
it
enrolls
a
CA
certificate.
B
But
that's
exactly
where
we
made
a
big
mistake,
because
we
thought,
when
enrolling
with
the
ca
profile,
we
get
a
signing
certificate
which
isn't
true
for
getting
a
signing
certificate.
We
have
to
enroll
with
the
default
profile
or
no
profile
at
all,
because
it
is
the
default
one,
and
then
we
get
a
signing
certificate
because
the
usage
of
the
default
profile
has
the
digital
signature
and
one
last
learning,
which
was
very
important
for
us,
is
the
usage
of
the
chain
certificates.
B
Now
we
never
really
knew
where
to
use
the
root
CA
certificate
and
where
to
use
the
chain
file,
and
it
turns
out
that
everywhere
in
the
orderer
and
peer
configs,
where
there
is
a
root
certificate
wanted,
you
have
to
specify
the
chain
file
and
not
the
root
CA
certificate
in
the
documentation
that
isn't
that.
Clearly,
that
clearly
mentioned
so
it
is
important
to
take
away,
and
now,
let's
take
some
conclusions
over
all
of
this.
First
of
all,
we
asked
ourselves
if
this
was
really
worth
it
and
we
want
to
be
honest
for
us.
B
The
step
from
crypto
gen
to
fabric
CA
at
the
moment
has
hardly
paid
off.
We
invested
a
lot
of
time
and
hard
work,
and
at
the
moment
our
Network
just
runs
the
exact
same
like
it
did
before,
like
there's,
no
big
difference
seeable,
but-
and
this
is
very
important-
we
no
longer
only
have
a
one-way
ticket.
So
when
we
are
looking
into
the
future,
we
experienced
fabric
CA
as
a
reliable
technical,
mature
solution.
B
So
in
case
of
an
incident
with
our
crypto
material,
we
are
now
ready
to
react
as
of
before
we
weren't
so
and
that's
worth
very
much.
We
have
to
say
and
for
all
of
you,
it
is
definitely
worth
it
because
the
step
for
you
now
has
just
gotten
a
little
bit
smaller,
but
talking
about
the
future,
there
is
one
important
topic
to
mention
that
has
to
be
studied
before
you
can
go
into
production
mode
with
fabric
CA.
There
are
many
other.
Yes,
the
topic
is
manage:
managing
the
entire
cryptograph
crypto
material
life
cycle.
B
Yes,
we
just
presented
to
you
our
whole
journey
and
what
is
what
it
all
was
worth
it.
So
we
asked
ourselves
what
can
all
of
you
take
away
from
all
of
this
and
we
thought
well,
there
are
many
things,
but
nevertheless
we
want
to
Tunnel
down
on
one
specific
key
takeaway,
because
while
we
were
working
on
this
presentation,
we
came
across
a
fundamental
insight
for
us.
A
A
A
A
Ca
server
and
fabric
CA
client
binary
how
they
can
be
used,
but
like
for
a
tutorial
of
fabric
CA,
we
struggled
to
to
find
like
the
space
in
the
Rita
talks
because
fabric
Cas,
when
we
run
this
in
a
single
instance,
it's
very
well
documented.
We
thought
that
we
can
develop
or
work
with
this
documentation
very
well,
but,
like
the
hierarchy
is
it's
like
never
mentioned
clearly
in
the
read
the
docs,
so
we
decided,
or
we
thought
that
in
the
samples
it
would
be
more
accurate.
B
Which
we
all
have
support
for
the
last
20
years
of
expired
certificates,
you
know
and
things
Crashing
Down.
Yes,
so
this
exact
solution
we've
presented,
we
have
now
running
for
half
a
year
or
so
so
not
that
long,
but
the
we
we
researched
a
lot
of
stuff
about
re-enrolling,
generating
certificate,
revocation
lists
and
what
to
do
in
case
of
compromised
material.
So
we
are
ready
in
a
case
of
anything,
would
happen,
but
yes,
the
struggles
we
never
really
experienced.
Until
this
point.
A
Yeah
we
can
say
we
have
done
a
crown
shop
running
on
kubernetes
to
find
out
if
a
certificate
will
expire
soon.
So
not
a
single
certificate
is
expired
by
now,
but
we
can
test
the
whole
exchange
with
revoking
a
certificate,
and
we
have
done
this
and
all
the
pain
which
comes
with,
like
Aaron,
said
in
the
presentation,
with
the
renaming
stuff
at
at
the
very
end,
but
in
before,
like
the
revoking
the
creating
the
revocation
list
and
the
channel
config
updates
and
like
we,
we
managed
to
do
this
by
now,
but
yeah.
A
A
Workplace
yeah,
the
topic
at
this
time
was
the
connection
of
identities
related
to
between
fabric
CA
and
hype
letter
Indie
and
yeah
we're
pretty
new
to
Indy.
So
we
like
implemented
a
solution
with
fabric
CA,
so
we're
we're
kind
of
new,
and
if
we
want
to
discuss
this
with
some
other
country
contributors,
we're
open
to
do
this
yeah
pretty
much
neighbor.
A
A
A
It's
important
to
mention
that
we
issue
identities
and
the
crypto
crypto
material
for
like
technical
users,
so
are
all
our
peers
and
orders
running.
They
use
our
crypto
material
and,
like
the
whole
client
stuff
we
handle
with
our
partner,
which
provides
the
front-end
Network
and
we
only
handle
the
fabric
Network.
So
we
issue
like
technical
identities.
Well,.