Open theblop opened 2 years ago
@davidkel this one goes with https://github.com/hyperledger/fabric/issues/2972
I don't think you can use an HSM to store TLS certificates because it's not the fabric code base that does the TLS Handling (and that code base won't try to communicate with the HSM) so you should generate the fabric-ca-server TLS certificates yourself (not using the HSM) and reference those, otherwise it looks like fabric-ca-server attempts to generate them via the BCCSP which is configured for PKCS11 and fails because it tries to register with an identical ID and IDs must be unique.
@davidkel indeed this is what I suspected and reported in https://github.com/hyperledger/fabric/issues/2972#issuecomment-937543866
This is obviously not ideal to have to generate the TLS certs outside of fabric-ca-server when using PKCS11 instead of the SW BCCSP, especially since the error isn't so obvious with softhsm which doesn't need AltId and doesn't fail immediately on the TLS cert generation step. Could this possibly be documented clearly in the doc here https://hyperledger-fabric-ca.readthedocs.io/en/v1.5.0/users-guide.html#configuring-an-hsm to avoid frustration for other poor souls stuck with AWS CloudHSM ? :)
@theblop Using an HSM for TLS certs is not possible both in fabric and fabric-ca, and if it isn't documented in either then I agree it should be. I'll add a comment back to hyperledger/fabric#2972 to also include this information in the fabric docs as well if it isn't there
Now I'm trying to generate a separate TLS cert for fabric-ca-server with openssl, the server starts but I get "certificate signed by unknown authority" from fabric-ca-client (I set --tls.certfiles to point to the openssl self signed cert). With openssl -connect I get a "bad record MAC" error.
Now maybe the TLS cert has to be signed by the ca-cert generated by fabric-ca-server init? In that case I can't see how it's possible to use AWS CloudHSM at all with fabric-ca...
What do you think @davidkel ?
Seems like there are a couple of different issues here:
1) It is true that the TLS stack in fabric and fabric-ca does not support PKCS11. So you need to have the key and cert files to start the TLS server.
2) It appears that the path to generate the TLS server cert for fabric-ca-server attempts to use the configured crypto provider rather than using the SW provider to generate the TLS cert. See https://github.com/hyperledger/fabric-ca/blob/v1.5.2/lib/server.go#L861
3) Need to check why the fabric-ca-client does not support trusting self-signed certificates. Typically they will be signed by a CA, but self-signed should work.
I wonder if it's possible to work around this by first bringing up a fabric-ca-server in SW mode to generate the TLS key and cert, then change the config to PKCS11 and re-bring up the fabric-ca-server ?
Im trying to register and enroll peer identities running a fabric-ca container with SW mode. But fabric-ca-client is failing with the same error as in this issue.
Error: Failure generating CSR: Failed generating ECDSA P256 key: P11: keypair generate failed [pkcs11: 0x13: CKR_ATTRIBUTE_VALUE_INVALID]
Hello,
I'm trying to setup a fabric-ca-server with AWS CloudHSM:
I use the library cloudhsm-pkcs11 v5.2.1-2 on ubuntu 18.04 (there are no more recent ubuntu versions supported by AWS cloudHSM at this time)
I configured a couple of HSM servers in an HSM cluster and added a "fabric" CU (Crypto User) with the aws HSM cli:
I configured both fabric-ca-server-config.yaml and fabric-ca-client-config.yaml with:
I init the CA server (the MSP key is successfully stored in the HSM):
But then when I start the server, the TLS self-signed cert generation fails:
Here is the corresponding cloudhsm log:
I had no problem with the TLS cert generation with the softhsm driver, so maybe the problem with AWS is the AltId setting which is the same here for the generated MSP CA cert and the TLS cert? Also I don't really know what to make of the "Error: User is already logged in" in the cloudhsm log...