ssl - SSL 错误：握手失败并出现致命错误 - 在启用 TLS 的 Fabric 网络上查询 fabric-sdk-rest 服务器

Question

docker swarm我使用fabric-sdk-rest启动了一个由1个CA-server、1个Orderer、2个Peer（都在Org1中，一个在PC1上，一个在PC2上）、2个CouchBD（每个Peer一个）组成的多主机Fabric网络在 PC2 上运行。

现在，如果我在 Fabric 网络中禁用 TLS，一切正常。但如果我在网络中启用 TLS，SDK 将无法连接到无法查询的对等方。

这里我展示了网络和 fabric-sdk-rest 的配置：

(crypto-config.yaml)

OrdererOrgs:
  - Name: Orderer
    Domain: example.com
    Specs:
      - Hostname: orderer
PeerOrgs:
  - Name: Org1
    Domain: org1.example.com
    Template:
      Count: 2
    Users:
      Count: 0

（数据源.json）

{
  "db": {
    "name": "db",
    "connector": "memory"
  },
  "fabricDataSource": {
    "name": "fabricDataSource",
    "connector": "fabric",
    "keyStoreFile": "/tmp/fabricSDKStore",
    "fabricUser": {
      "username": "[e-mail]",
      "mspid": "Org1MSP",
      "cryptoContent": {
        "privateKey":"$HOME/mynetwork/crypto-config/peerOrganizations/org1.example.com/users/[e-mail]/msp/keystore/KEY_sk",
        "signedCert":"$HOME/mynetwork/crypto-config/peerOrganizations/org1.example.com/users/[e-mail]/msp/signcerts/[e-mail]"
      }
    },
    "COMMENT_orgs":"Referenced by peers to avoid having to configure the same file location multiple times. Change CACertFile locations for your fabric",
    "orgs": [
      { "name":"org1", "CACertFile":"$HOME/mynetwork/crypto-config/peerOrganizations/org1.example.com/ca/ca.org1.example.com-cert.pem"}
    ],
    "COMMENT_peers" : "Configured array is for use with the fabric-sample when running it in a local docker set up. eventURL and publicCertFile not currently used.",
    "peers": [
      { "requestURL":"grpcs://peer1.org1.example.com:7051", "eventURL":"grpcs://peer1.org1.example.com:7053", "orgIndex":"0", "publicCertFile":"$HOME/mynetwork/crypto-config/peerOrganizations/org1.example.com/peers/peer1.org1.example.com/msp/signcerts/peer1.org1.example.com-cert.pem", "hostname":"peer1" }
    ],
    "COMMENT_peers_secure" : "UNUSED. This is a copy of the above with grpcs URLs. Replace peers content with this if grpcs urls are needed.",
    "peers-secure": [
      { "requestURL":"grpcs://peer1.org1.example.com:7051", "eventURL":"grpcs://peer1.org1.example.com:7053", "orgIndex":"0", "publicCertFile":"$HOME/mynetwork/crypto-config/peerOrganizations/org1.example.com/peers/peer1.org1.example.com/msp/signcerts/peer1.org1.example.com-cert.pem", "hostname":"peer1" }
    ],
    "orderers": [
      { "url":"grpcs://orderer.example.com:7050", "CACertFile":"$HOME/mynetwork/crypto-config/ordererOrganizations/example.com/ca/ca.example.com-cert.pem", "publicCertFile": "$HOME/mynetwork/crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp/signcerts/orderer.example.com-cert.pem", "hostname":"orderer"}
    ],
    "COMMENT_orderers_secure" : "UNUSED. This is a copy of the above with grpcs URLs. Replace orderers content with this if grpcs urls are needed.",
    "orderers-secure": [
      { "url":"grpcs://orderer.example.com:7050", "CACertFile":"$HOME/mynetwork/crypto-config/ordererOrganizations/example.com/ca/ca.example.com-cert.pem", "publicCertFile": "$HOME/mynetwork/crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp/signcerts/orderer.example.com-cert.pem", "hostname":"orderer"}
    ],
    "COMMENT_channels":"fabric-sdk-node Client class requires channel information to be configured during bootstrap.",
    "channels": [
      { "name":"mychannel", "peersIndex":[0], "orderersIndex":[0] }
    ],
    "channels-first-network": [
      { "name":"mychannel", "peersIndex":[0,1,2,3], "orderersIndex":[0] }
    ]
  }
}

启动 Hyperledger Fabric SDK REST 服务器后https://0.0.0.0:3000，当我尝试GET channels从资源管理器进行查询时，我收到以下错误：

error: [fabricconnector.js]: Failed to queryChannels: Error: 14 UNAVAILABLE: Connect Failed
Error not handled for the GET request /api/fabric/1_0/channels: Error: 14 UNAVAILABLE: Connect Failed
    at Object.exports.createStatusError ($HOME/mynetwork/fabric-sdk-rest/packages/loopback-connector-fabric/node_modules/grpc/src/common.js:87:15)
    at Object.onReceiveStatus ($HOME/mynetwork/fabric-sdk-rest/packages/loopback-connector-fabric/node_modules/grpc/src/client_interceptors.js:1214:28)
    at InterceptingListener._callNext ($HOME/mynetwork/fabric-sdk-rest/packages/loopback-connector-fabric/node_modules/grpc/src/client_interceptors.js:590:42)
    at InterceptingListener.onReceiveStatus ($HOME/mynetwork/fabric-sdk-rest/packages/loopback-connector-fabric/node_modules/grpc/src/client_interceptors.js:640:8)
    at callback ($HOME/mynetwork/fabric-sdk-rest/packages/loopback-connector-fabric/node_modules/grpc/src/client_interceptors.js:867:24)
E0510 10:51:04.780559355   12247 ssl_transport_security.cc:989] Handshake failed with fatal error SSL_ERROR_SSL: error:14090086:SSL routines:ssl3_get_server_certificate:certificate verify failed.

有没有人见过这个错误？谁能帮我解决这个问题，好吗？

标签： sslhyperledger-fabrichyperledgerhandshake