Docker swarm deployment of Hyperledger fabric - hyperledger-fabric

I have got an issue that occurs when i deploy my project using docker swarm, the creation of a new object in world state database happens fine but while updating that object sometimes a mvcc error occurs. When i checked the logs it shows that the database does not exist, I feel the issue might be because of peer communication and batch timeout (this is my guess). I am using 1.4.6 version of fabric. The same scenario, i had tried to recreate while deploying using docker compose but it doesn't
Configtx.yaml
Organizations:
- &OrdererOrg
Name: OrdererMSP
ID: OrdererMSP
MSPDir: crypto-config/ordererOrganizations/xxxx.com/msp
Policies:
Readers:
Type: Signature
Rule: "OR('OrdererMSP.member')"
Writers:
Type: Signature
Rule: "OR('OrdererMSP.member')"
Admins:
Type: Signature
Rule: "OR('OrdererMSP.admin')"
- &Org1
Name: xxxxMSP
ID: xxxxMSP
MSPDir: crypto-config/peerOrganizations/xxxx.xxxx.com/msp
Policies:
Readers:
Type: Signature
Rule: "OR('xxxxMSP.admin', 'xxxxMSP.member')"
Writers:
Type: Signature
Rule: "OR('xxxxMSP.admin', 'xxxxMSP.member')"
Admins:
Type: Signature
Rule: "OR('xxxxMSP.admin')"
AnchorPeers:
- Host: peer0.xxxx.xxxx.com
Port: 7051
- &Org2
Name: xxxxMSP
ID: xxxxMSP
MSPDir: crypto-config/peerOrganizations/xxxx.xxxx.com/msp
Policies:
Readers:
Type: Signature
Rule: "OR('xxxxMSP.admin', 'xxxxMSP.member')"
Writers:
Type: Signature
Rule: "OR('xxxxMSP.admin', 'xxxxMSP.member')"
Admins:
Type: Signature
Rule: "OR('xxxxMSP.admin')"
AnchorPeers:
- Host: peer0.xxxx.xxxx.com
Port: 9051
Capabilities:
Channel: &ChannelCapabilities
V1_4_3: true
V1_3: false
V1_1: false
Orderer: &OrdererCapabilities
V1_4_2: true
V1_1: false
Application: &ApplicationCapabilities
V1_4_2: true
V1_3: false
V1_2: false
V1_1: false
Application: &ApplicationDefaults
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ApplicationCapabilities
Orderer: &OrdererDefaults
OrdererType: etcdraft
Addresses:
- orderer0.xxxx.com:7050
- orderer1.xxxx.com:7050
- orderer2.xxxx.com:7050
BatchTimeout: 2s
BatchSize:
MaxMessageCount: 10
AbsoluteMaxBytes: 99 MB
PreferredMaxBytes: 512 KB
EtcdRaft:
Consenters:
- Host: orderer0.xxxx.com
Port: 7050
ClientTLSCert: crypto-config/ordererOrganizations/xxxx.com/orderers/orderer0.xxxx.com/tls/server.crt
ServerTLSCert: crypto-config/ordererOrganizations/xxxx.com/orderers/orderer0.xxxx.com/tls/server.crt
- Host: orderer1.xxxx.com
Port: 7050
ClientTLSCert: crypto-config/ordererOrganizations/xxxx.com/orderers/orderer1.xxxx.com/tls/server.crt
ServerTLSCert: crypto-config/ordererOrganizations/xxxx.com/orderers/orderer1.xxxx.com/tls/server.crt
- Host: orderer2.xxxx.com
Port: 7050
ClientTLSCert: crypto-config/ordererOrganizations/xxxx.com/orderers/orderer2.xxxx.com/tls/server.crt
ServerTLSCert: crypto-config/ordererOrganizations/xxxx.com/orderers/orderer2.xxxx.com/tls/server.crt
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
BlockValidation:
Type: ImplicitMeta
Rule: "ANY Writers"
Channel: &ChannelDefaults
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ChannelCapabilities
Profiles:
xxxxGenesis:
<<: *ChannelDefaults
Orderer:
<<: *OrdererDefaults
Organizations:
- *OrdererOrg
Capabilities:
<<: *OrdererCapabilities
Consortiums:
SampleConsortium:
Organizations:
- *Org1
- *Org2
CV_Channel:
Consortium: SampleConsortium
<<: *ChannelDefaults
Application:
<<: *ApplicationDefaults
Organizations:
- *Org1
- *Org2
Capabilities:
<<: *ApplicationCapabilities
Peer container logs
{"log":"\u001b[34m2020-09-15 08:03:37.496 UTC [couchdb] CreateDatabaseIfNotExist -\u003e INFO 02b\u001b[0m Created state database cvchannel_\n","stream":"stderr","time":"2020-09-15T08:03:37.497361704Z"}
{"log":"\u001b[31m2020-09-15 08:03:37.674 UTC [couchdb] runWarmIndexAllIndexes -\u003e ERRO 02c\u001b[0m Error detected during WarmIndexAllIndexes(): error handling CouchDB request. Error:not_found, Status Code:404, Reason:Database does not exist.\n","stream":"stderr","time":"2020-09-15T08:03:37.674619911Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchInstance).handleRequest\n","stream":"stderr","time":"2020-09-15T08:03:37.674649981Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1847\n","stream":"stderr","time":"2020-09-15T08:03:37.674656059Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).handleRequest\n","stream":"stderr","time":"2020-09-15T08:03:37.674661185Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1650\n","stream":"stderr","time":"2020-09-15T08:03:37.674666013Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).ListIndex\n","stream":"stderr","time":"2020-09-15T08:03:37.674670852Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1151\n","stream":"stderr","time":"2020-09-15T08:03:37.674675596Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).WarmIndexAllIndexes\n","stream":"stderr","time":"2020-09-15T08:03:37.674680273Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1324\n","stream":"stderr","time":"2020-09-15T08:03:37.674684939Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).runWarmIndexAllIndexes\n","stream":"stderr","time":"2020-09-15T08:03:37.674689595Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1311\n","stream":"stderr","time":"2020-09-15T08:03:37.674708559Z"}
{"log":"runtime.goexit\n","stream":"stderr","time":"2020-09-15T08:03:37.674713109Z"}
{"log":"\u0009/opt/go/src/runtime/asm_amd64.s:1337\n","stream":"stderr","time":"2020-09-15T08:03:37.674717108Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.692 UTC [kvledger] CommitWithPvtData -\u003e INFO 02d\u001b[0m [cvchannel] Committed block [0] with 1 transaction(s) in 172ms (state_validation=1ms block_and_pvtdata_commit=64ms state_commit=94ms) commitHash=[]\n","stream":"stderr","time":"2020-09-15T08:03:37.693007188Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.695 UTC [ledgermgmt] CreateLedger -\u003e INFO 02e\u001b[0m Created ledger [cvchannel] with genesis block\n","stream":"stderr","time":"2020-09-15T08:03:37.695884567Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.712 UTC [gossip.gossip] JoinChan -\u003e INFO 02f\u001b[0m Joining gossip network of channel cvchannel with 2 organizations\n","stream":"stderr","time":"2020-09-15T08:03:37.712518745Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.712 UTC [gossip.gossip] learnAnchorPeers -\u003e INFO 030\u001b[0m No configured anchor peers of xxxxMSP for channel cvchannel to learn about\n","stream":"stderr","time":"2020-09-15T08:03:37.712607056Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.712 UTC [gossip.gossip] learnAnchorPeers -\u003e INFO 031\u001b[0m No configured anchor peers of xxxxMSP for channel cvchannel to learn about\n","stream":"stderr","time":"2020-09-15T08:03:37.712680067Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.740 UTC [gossip.state] NewGossipStateProvider -\u003e INFO 032\u001b[0m Updating metadata information for channel cvchannel, current ledger sequence is at = 0, next expected block is = 1\n","stream":"stderr","time":"2020-09-15T08:03:37.741210227Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.742 UTC [sccapi] deploySysCC -\u003e INFO 033\u001b[0m system chaincode lscc/cvchannel(github.com/hyperledger/fabric/core/scc/lscc) deployed\n","stream":"stderr","time":"2020-09-15T08:03:37.743086696Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [cscc] Init -\u003e INFO 034\u001b[0m Init CSCC\n","stream":"stderr","time":"2020-09-15T08:03:37.74339807Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [sccapi] deploySysCC -\u003e INFO 035\u001b[0m system chaincode cscc/cvchannel(github.com/hyperledger/fabric/core/scc/cscc) deployed\n","stream":"stderr","time":"2020-09-15T08:03:37.743424102Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [qscc] Init -\u003e INFO 036\u001b[0m Init QSCC\n","stream":"stderr","time":"2020-09-15T08:03:37.743544721Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [sccapi] deploySysCC -\u003e INFO 037\u001b[0m system chaincode qscc/cvchannel(github.com/hyperledger/fabric/core/scc/qscc) deployed\n","stream":"stderr","time":"2020-09-15T08:03:37.743558369Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [sccapi] deploySysCC -\u003e INFO 038\u001b[0m system chaincode (+lifecycle,github.com/hyperledger/fabric/core/chaincode/lifecycle) disabled\n","stream":"stderr","time":"2020-09-15T08:03:37.743790508Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [endorser] callChaincode -\u003e INFO 039\u001b[0m [][a3cc0bd2] Exit chaincode: name:"cscc" (431ms)\n","stream":"stderr","time":"2020-09-15T08:03:37.744038661Z"}
{"log":"\u001b[34m2020-09-15 08:03:37.743 UTC [comm.grpc.server] 1 -\u003e INFO 03a\u001b[0m unary call completed grpc.service=protos.Endorser grpc.method=ProcessProposal grpc.peer_address=10.0.4.4:33316 grpc.code=OK grpc.call_duration=435.114623ms\n","stream":"stderr","time":"2020-09-15T08:03:37.744207412Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.750 UTC [gossip.election] beLeader -\u003e INFO 03b\u001b[0m 5fc3148715eaea54bba5cae87f301cbeca436e2d8842d7e5b9469c5b8398d314 : Becoming a leader\n","stream":"stderr","time":"2020-09-15T08:03:43.751403096Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.751 UTC [gossip.service] func1 -\u003e INFO 03c\u001b[0m Elected as a leader, starting delivery service for channel cvchannel\n","stream":"stderr","time":"2020-09-15T08:03:43.751480343Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.752 UTC [deliveryClient] StartDeliverForChannel -\u003e INFO 03d\u001b[0m This peer will retrieve blocks from ordering service and disseminate to other peers in the organization for channel cvchannel\n","stream":"stderr","time":"2020-09-15T08:03:43.752972274Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.765 UTC [deliveryClient] RequestBlocks -\u003e INFO 03e\u001b[0m Starting deliver with block [1] for channel cvchannel\n","stream":"stderr","time":"2020-09-15T08:03:43.765848602Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.774 UTC [gossip.privdata] StoreBlock -\u003e INFO 03f\u001b[0m [cvchannel] Received block [1] from buffer\n","stream":"stderr","time":"2020-09-15T08:03:43.774744553Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.782 UTC [gossip.gossip] JoinChan -\u003e INFO 040\u001b[0m Joining gossip network of channel cvchannel with 2 organizations\n","stream":"stderr","time":"2020-09-15T08:03:43.782642453Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.782 UTC [gossip.gossip] learnAnchorPeers -\u003e INFO 041\u001b[0m No configured anchor peers of xxxxMSP for channel cvchannel to learn about\n","stream":"stderr","time":"2020-09-15T08:03:43.782658448Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.782 UTC [gossip.gossip] learnAnchorPeers -\u003e INFO 042\u001b[0m Learning about the configured anchor peers of xxxxMSP for channel cvchannel : [{peer0.xxxx.xxxx.com 7051}]\n","stream":"stderr","time":"2020-09-15T08:03:43.782662723Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.782 UTC [gossip.gossip] learnAnchorPeers -\u003e INFO 043\u001b[0m Anchor peer with same endpoint, skipping connecting to myself\n","stream":"stderr","time":"2020-09-15T08:03:43.782666538Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.783 UTC [committer.txvalidator] Validate -\u003e INFO 044\u001b[0m [cvchannel] Validated block [1] in 9ms\n","stream":"stderr","time":"2020-09-15T08:03:43.784169783Z"}
{"log":"\u001b[31m2020-09-15 08:03:43.845 UTC [couchdb] runWarmIndexAllIndexes -\u003e ERRO 045\u001b[0m Error detected during WarmIndexAllIndexes(): error handling CouchDB request. Error:not_found, Status Code:404, Reason:Database does not exist.\n","stream":"stderr","time":"2020-09-15T08:03:43.845975731Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchInstance).handleRequest\n","stream":"stderr","time":"2020-09-15T08:03:43.846007175Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1847\n","stream":"stderr","time":"2020-09-15T08:03:43.846012195Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).handleRequest\n","stream":"stderr","time":"2020-09-15T08:03:43.846016704Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1650\n","stream":"stderr","time":"2020-09-15T08:03:43.846020817Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).ListIndex\n","stream":"stderr","time":"2020-09-15T08:03:43.846024956Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1151\n","stream":"stderr","time":"2020-09-15T08:03:43.846028939Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).WarmIndexAllIndexes\n","stream":"stderr","time":"2020-09-15T08:03:43.846033069Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1324\n","stream":"stderr","time":"2020-09-15T08:03:43.846037135Z"}
{"log":"github.com/hyperledger/fabric/core/ledger/util/couchdb.(*CouchDatabase).runWarmIndexAllIndexes\n","stream":"stderr","time":"2020-09-15T08:03:43.846041182Z"}
{"log":"\u0009/opt/gopath/src/github.com/hyperledger/fabric/core/ledger/util/couchdb/couchdb.go:1311\n","stream":"stderr","time":"2020-09-15T08:03:43.846045266Z"}
{"log":"runtime.goexit\n","stream":"stderr","time":"2020-09-15T08:03:43.846049541Z"}
{"log":"\u0009/opt/go/src/runtime/asm_amd64.s:1337\n","stream":"stderr","time":"2020-09-15T08:03:43.846053454Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.865 UTC [kvledger] CommitWithPvtData -\u003e INFO 046\u001b[0m [cvchannel] Committed block [1] with 1 transaction(s) in 81ms (state_validation=0ms block_and_pvtdata_commit=29ms state_commit=39ms) commitHash=[47dc540c94ceb704a23875c11273e16bb0b8a87aed84de911f2133568115f254]\n","stream":"stderr","time":"2020-09-15T08:03:43.865566497Z"}
{"log":"\u001b[34m2020-09-15 08:03:43.946 UTC [endorser] callChaincode -\u003e INFO 047\u001b[0m [][29451530] Entry chaincode: name:"lscc" \n","stream":"stderr","time":"2020-09-15T08:03:43.94617674Z"}
{"log":"\u001b[34m2020-09-15 08:03:44.017 UTC [couchdb] CreateDatabaseIfNotExist -\u003e INFO 048\u001b[0m Created state database cvchannel_lscc\n","stream":"stderr","time":"2020-09-15T08:03:44.018004477Z"}
{"log":"\u001b[34m2020-09-15 08:03:44.020 UTC [lscc] executeInstall -\u003e INFO 049\u001b[0m Installed Chaincode [certcc] Version [1.0] to peer\n","stream":"stderr","time":"2020-09-15T08:03:44.020291974Z"}
{"log":"\u001b[34m2020-09-15 08:03:44.020 UTC [endorser] callChaincode -\u003e INFO 04a\u001b[0m [][29451530] Exit chaincode: name:"lscc" (74ms)\n","stream":"stderr","time":"2020-09-15T08:03:44.020511347Z"}
{"log":"\u001b[34m2020-09-15 08:03:44.020 UTC [comm.grpc.server] 1 -\u003e INFO 04b\u001b[0m unary call completed grpc.service=protos.Endorser grpc.method=ProcessProposal grpc.peer_address=10.0.4.4:33328 grpc.code=OK grpc.call_duration=75.164566ms\n","stream":"stderr","time":"2020-09-15T08:03:44.020765429Z"}
{"log":"\u001b[34m2020-09-15 08:04:00.231 UTC [comm.grpc.server] 1 -\u003e INFO 04c\u001b[0m unary call completed grpc.service=gossip.Gossip grpc.method=Ping grpc.request_deadline=2020-09-15T08:04:02.231Z grpc.peer_address=10.0.4.4:57698 grpc.peer_subject="CN=peer1.xxxx.xxxx.com,OU=peer+OU=xxxx,O=Hyperledger,ST=North Carolina,C=US" grpc.code=OK grpc.call_duration=184.503µs\n","stream":"stderr","time":"2020-09-15T08:04:00.231875809Z"}
{"log":"\u001b[34m2020-09-15 08:04:00.243 UTC [comm.grpc.server] 1 -\u003e INFO 04d\u001b[0m streaming call completed grpc.service=gossip.Gossip grpc.method=GossipStream grpc.request_deadline=2020-09-15T08:04:10.233Z grpc.peer_address=10.0.4.4:57698 grpc.peer_subject="CN=peer1.xxxx.xxxx.com,OU=peer+OU=xxxx,O=Hyperledger,ST=North Carolina,C=US" error="rpc error: code = Canceled desc = context canceled" grpc.code=Canceled grpc.call_duration=9.822291ms\n","stream":"stderr","time":"2020-09-15T08:04:00.243456691Z"}

Related

TLS handshake failed with error remote error: tls: bad certificate server=Orderer using Raft and Intermediate certs

I see there are a lot of questions about this error, I have seen this solution Raft bad format but I doubled checked and the folders are right and the certs are in there, I also looked at Sans problem but for what I understand I don't need Sans when using Raft (I may be wrong). I think my problem its because I'm not handling the intermediate certificates correctly and I'm getting the error both creating a channel and in the Raft consensus.
So here is what I've done so far:
I created my genesis block using a configtx.yaml and this msp folder structure:
configtx.yaml
Organizations:
- &ordererOrg
Name: orderer
ID: orderer
MSPDir: /crypto/msp
Policies:
Readers:
Type: Signature
Rule: "OR('orderer.member')"
Writers:
Type: Signature
Rule: "OR('orderer.member')"
Admins:
Type: Signature
Rule: "OR('orderer.admin')"
Capabilities:
Channel: &ChannelCapabilities
V1_4_3: true
Orderer: &OrdererCapabilities
V1_4_2: true
Application: &ApplicationCapabilities
V1_4_2: true
Application: &ApplicationDefaults
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ApplicationCapabilities
Orderer: &OrdererDefaults
OrdererType: solo
BatchTimeout: 2s
BatchSize:
MaxMessageCount: 10
AbsoluteMaxBytes: 99 MB
PreferredMaxBytes: 512 KB
Kafka:
Brokers:
- 127.0.0.1:9092
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
BlockValidation:
Type: ImplicitMeta
Rule: "ANY Writers"
Channel: &ChannelDefaults
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ChannelCapabilities
Profiles:
SampleEtcdRaftProfile:
<<: *ChannelDefaults
Capabilities:
<<: *ChannelCapabilities
Orderer:
<<: *OrdererDefaults
OrdererType: etcdraft
Addresses:
- orderer1.xxxx.eastus.aksapp.io:443
- orderer2.xxxx.eastus.aksapp.io:443
Organizations:
- *ordererOrg
EtcdRaft:
Consenters:
- Host: orderer1
Port: 7050
ClientTLSCert: /crypto/orderers/orderer1/tls/server.crt
ServerTLSCert: /crypto/orderers/orderer1/tls/server.crt
- Host: orderer2
Port: 7050
ClientTLSCert: /crypto/orderers/orderer2/tls/server.crt
ServerTLSCert: /crypto/orderers/orderer2/tls/server.crt
Capabilities:
<<: *OrdererCapabilities
Application:
<<: *ApplicationDefaults
Organizations:
- <<: *ordererOrg
Consortiums:
SampleConsortium:
Organizations:
- *ordererOrg
MSP folder structure:
+ /crypto
configtx.yaml
+ msp
+ cacerts > ca.crt
+ tlscacerts > ca.crt
+ intermediatecerts > intermediate.crt
+ tlsintermediatecerts > intermediate.crt
+ admincerts > admin.crt
+ orderers
+ orderer1/tls > server.crt
+ orderer2/tls > server.crt
I created my genesis block using this:
configtxgen -profile SampleEtcdRaftProfile -outputBlock genesis.block -channelID mychannel
Now here I have a doubt inside my orderer the msp structure is like this:
+ /var/hyperledger/orderer
genesis.block
+ msp
+ cacerts > ca.crt
+ intermediatecerts > intermediate.crt
+ admincerts > admin.crt
+ signcerts > cert.pem
+ keystore > key.pem
+ tls
server.crt
server.key
ca.crt
intermediate.crt
And these are my env variables:
ORDERER_GENERAL_TLS_ENABLED=true
ORDERER_GENERAL_TLS_PRIVATEKEY=/var/hyperledger/orderer/tls/server.key
ORDERER_GENERAL_TLS_CERTIFICATE=/var/hyperledger/orderer/tls/server.crt
ORDERER_GENERAL_TLS_CLIENTROOTCAS=/var/hyperledger/orderer/tls/ca.crt
ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED=false
ORDERER_GENERAL_CLUSTER_CLIENTPRIVATEKEY=/var/hyperledger/orderer/tls/server.key
ORDERER_GENERAL_CLUSTER_CLIENTCERTIFICATE=/var/hyperledger/orderer/tls/server.crt
ORDERER_GENERAL_CLUSTER_ROOTCAS=/var/hyperledger/orderer/tls/ca.crt
I'm not sure why the structure is different and the tls files are somewhere else but I am copying the configuration from the azure hyperledger template That I have already used successfuly.
Now my orderers are running but orderer1 keeps starting a new election and orderer 2 becomes precandidate and finally fails with a TLS handshake error.
These are the error logs in orderer2:
2021-03-23 22:15:21.969 UTC [orderer.consensus.etcdraft] Step -> INFO f96 2 is starting a new election at term 1 channel=canalenergia node=2
2021-03-23 22:15:21.969 UTC [orderer.consensus.etcdraft] becomePreCandidate -> INFO f97 2 became pre-candidate at term 1 channel=canalenergia node=2
2021-03-23 22:15:21.969 UTC [orderer.consensus.etcdraft] poll -> INFO f98 2 received MsgPreVoteResp from 2 at term 1 channel=canalenergia node=2
2021-03-23 22:15:21.969 UTC [orderer.consensus.etcdraft] campaign -> INFO f99 2 [logterm: 1, index: 2] sent MsgPreVote request to 1 at term 1 channel=canalenergia node=2
2021-03-23 22:15:26.673 UTC [core.comm] ServerHandshake -> ERRO f9a TLS handshake failed with error remote error: tls: bad certificate server=Orderer remoteaddress=x.x.x.x:45472
I tried deleting intermediate.crt and mixing ca.crt and intermediate.crt into one file in ca.crt in the tls folder of the orderer like this:
-----BEGIN CERTIFICATE-----
ROOTCERTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
INTERMEDIATExxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-----END CERTIFICATE-----
But it didn't work either.
I tried openssl verify -CAfile chain.crt orderer1-tls.crt and returns OK.
This is what happens when I try to create a new channel:
peer channel create -o orderer1.xxxx.eastus.aksapp.io -c testchannel -f ./channel.tx --tls --cafile /var/hyperledger/peer/msp/tlscacerts/ca.crt --clientauth --certfile /var/hyperledger/peer/tls/cert.pem --keyfile /var/hyperledger/peer/tls/key.pem
2021-03-24 00:04:40.331 UTC [comm.tls] ClientHandshake -> ERRO 001 Client TLS handshake failed after 939.077µs with error: EOF remoteaddress=x.x.x.x:443
I tested my urls with telnet and they are ok.
I created my certificates using openSSL but I don't see anything wrong in them, the only difference is that they aren't signed by a fabric-ca but by an intermediate CA from a big company.
I have double checked all the values but I guess orderer wouldn't even be running if they weren't right and followed this script from azure for the creation of the genesis block only adding the intermediate info.
Any advice would be great.
Thanks
UPDATE:
I activated the debug logs with this variable:
FABRIC_LOGGING_SPEC="grpc=debug:info"
And found the problem is this:
transport: authentication handshake failed: x509: certificate is not valid for any names, but wanted to match orderer1
My certificate has this subject:
CN=orderer1-tls#blockchain.company.com,O=Company,L=CITY,ST=STATE,C=US
Now, I don't understand why its telling me it doesn't have a name, I though the CN orderer1-tls#blockchain.company.com was the name, and, also, where did I tell the orderer that the name to search is "orderer1"?
UPDATE 2:
I changed my TLS certificates to CN=orderer.company.com and then the error was this:
x509: certificate is valid for orderer1.company.com, not orderer1
So as 李可以 says, the orderer is expecting the hostname in the certificate CN and my hostname is orderer1 so I changed it to that.
Now I'm getting a new error:
UTC [comm.grpc.server] 1 -> INFO 118 streaming call completed grpc.service=orderer.Cluster grpc.method=Step grpc.peer_address=x.x.x.x:39424 error="no TLS certificate sent" grpc.code=Unknown grpc.call_duration=161.713µs
I guess This is a new error so I'm going to open a new question. thanks!
Ana
I have same problem when i study fabric.and i have solve them,hope this can help you.
for example,when you execute in linux terminal
export CORE_PEER_TLS_ENABLED=true
export CORE_PEER_LOCALMSPID="Org1MSP"
export CORE_PEER_TLS_ROOTCERT_FILE=/home/www/byfn-on-k8s/crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt
export CORE_PEER_MSPCONFIGPATH=/home/www/byfn-on-k8s/crypto-config/peerOrganizations/org1.example.com/users/Admin#org1.example.com/msp
export CORE_PEER_ADDRESS=peer0.org1.example.com:30011
peer channe list
you will get correct result
and change CORE_PEER_ADDRESS to exmaple.com(example.com link same ip to peer0.org1.example.com,you can setup by edit /etc/hosts),
export CORE_PEER_ADDRESS=example.com:30011
peer channe list
and you will get error "TLS handshake failed with error remote error: tls: bad certificate server=PeerServer"in peer log
but this is not the only scene when you meet error "tls: bad certificate",
and i think this error is caused by the "hostname vertify"
for instance,you want to access peer peer0.org1.example.com,and this peer enable server tls,you can find the server.crt and server.key in peer env.
if you parse the server.crt,you will find the CN of this crt is "peer0.org1.example.com"
when you contact to peer "peer0.org1.example.com", the peer will send you its cert,and you find the CN of th cert is "peer0.org1.example.com",so you trust this server,
but when you contact to "example.com" (point to same IP with peer0.org1.example.com),and the peer send you its cert ,you find the CN of the cert is "peer0.org1.example.com" ,id not equal "example.com",so you dont trust this server and get error.
I think the new error "no TLS certificate sent" was caused by you have set CORE_PEER_TLS_CLIENTAUTHREQUIRED=true on your orderer env.
so I try to test when CORE_PEER_TLS_CLIENTAUTHREQUIRED=true,I meet another error "tls:bad certificate" when raft elect,so I change the orderer env like these:
- ORDERER_GENERAL_TLS_ENABLED=true
- ORDERER_GENERAL_TLS_PRIVATEKEY=/var/hyperledger/orderer/tls/server.key
- ORDERER_GENERAL_TLS_CERTIFICATE=/var/hyperledger/orderer/tls/server.crt
- ORDERER_GENERAL_TLS_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
- ORDERER_KAFKA_TOPIC_REPLICATIONFACTOR=1
- ORDERER_KAFKA_VERBOSE=true
- ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED=true
- ORDERER_GENERAL_TLS_CLIENTROOTCAS=/var/hyperledger/orderer/tls/ca.crt
- ORDERER_GENERAL_CLUSTER_CLIENTCERTIFICATE=/var/hyperledger/orderer/tls/server.crt
- ORDERER_GENERAL_CLUSTER_CLIENTPRIVATEKEY=/var/hyperledger/orderer/tls/server.key
- ORDERER_GENERAL_CLUSTER_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt]
and there are no error during elect,but when I try to create channel,I did't set authclient
peer channel create -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/channel.tx --tls true --cafile /root/go/src/github.com/hyperledger/fabric-samples/first-network/crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem
I did't set authclient,I meet another error
TLS handshake failed with error tls: client didn't provide a certificate server=Orderer remoteaddress=192.168.192.11:57372
so I change my command
peer channel create -o orderer.example.com:7050 -c mychannel -f ./channel-artifacts/channel.tx --tls true --cafile /root/go/src/github.com/hyperledger/fabric-samples/first-network/crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem --clientauth --certfile /root/go/src/github.com/hyperledger/fabric-samples/first-network/crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt --keyfile /root/go/src/github.com/hyperledger/fabric-samples/first-network/crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key
and it exec success,you can see the --certfile value is peer's server.crt and --keyfile value is peer's server key.
so I think the problem you had meet is caused by client side tls,you can check the client side crt and key is correct or not.
Hope these are useful to you.

peer lifecycle chaincode approveformyorg Error: failed to send transaction: got unexpected status: NOT_FOUND -- channel does not exist

When I was conducting chain code approval, I encountered the following problem: Error: failed to send transaction: got unexpected status: NOT_FOUND -- Channel does not exist.I have successfully executed the operation of chain code packaging and chain code installation, but I cannot continue when executing the chain code approval. Have you encountered any such problems? thank you
Here is the information for the current node:
bash-5.0# peer channel list
2020-09-21 10:18:18.939 UTC [channelCmd] InitCmdFactory -> INFO 001 Endorser and orderer connections initialized
Channels peers has joined:
example-channel
bash-5.0# peer lifecycle chaincode queryinstalled
Installed chaincodes on peer:
Package ID: mycc_1:2499940fe909cc71a661bf79a3d78523a43c4d2879f4456e6cbe4a2a5a5e5246, Label: mycc_1
========================2020-09-22===================
this is my configtx.yaml
Organizations:
- &OrdererOrg
Name: OrdererOrg
ID: OrdererMSP
MSPDir: ./crypto-config/ordererOrganizations/example.com/msp
Policies:
Readers:
Type: Signature
Rule: "OR('OrdererMSP.member')"
Writers:
Type: Signature
Rule: "OR('OrdererMSP.member')"
Admins:
Type: Signature
Rule: "OR('OrdererMSP.admin')"
- &Org1
Name: Org1MSP
ID: Org1MSP
MSPDir: ./crypto-config/peerOrganizations/org1.example.com/msp
Policies:
Readers:
Type: Signature
Rule: "OR('Org1MSP.admin', 'Org1MSP.peer', 'Org1MSP.client')"
Writers:
Type: Signature
Rule: "OR('Org1MSP.admin', 'Org1MSP.client')"
Admins:
Type: Signature
Rule: "OR('Org1MSP.admin')"
AnchorPeers:
- Host: peer0.org1.example.com
Port: 7051
- &Org2
Name: Org2MSP
ID: Org2MSP
MSPDir: ./crypto-config/peerOrganizations/org2.example.com/msp
Policies:
Readers:
Type: Signature
Rule: "OR('Org2MSP.admin', 'Org2MSP.peer', 'Org2MSP.client')"
Writers:
Type: Signature
Rule: "OR('Org2MSP.admin', 'Org2MSP.client')"
Admins:
Type: Signature
Rule: "OR('Org2MSP.admin')"
AnchorPeers:
- Host: peer0.org2.example.com
Port: 7051
Capabilities:
Channel: &ChannelCapabilities
V2_0: true
Orderer: &OrdererCapabilities
V2_0: true
Application: &ApplicationCapabilities
V2_0: true
Application: &ApplicationDefaults
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ApplicationCapabilities
Orderer: &OrdererDefaults
OrdererType: etcdraft
Addresses: # orderer
- orderer.example.com:7050
- orderer2.example.com:7050
- orderer3.example.com:7050
- orderer4.example.com:7050
- orderer5.example.com:7050
BatchTimeout: 2s
BatchSize:
MaxMessageCount: 10
AbsoluteMaxBytes: 99 MB
PreferredMaxBytes: 512 KB
Organizations:
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
BlockValidation:
Type: ImplicitMeta
Rule: "ANY Writers"
Channel: &ChannelDefaults
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Capabilities:
<<: *ChannelCapabilities
Profiles:
TwoOrgsChannel:
Consortium: SampleConsortium
<<: *ChannelDefaults
Application:
<<: *ApplicationDefaults
Organizations:
- *Org1
- *Org2
Capabilities:
<<: *ApplicationCapabilities
SampleMultiNodeEtcdRaft:
<<: *ChannelDefaults
Capabilities:
<<: *ChannelCapabilities
Orderer:
<<: *OrdererDefaults
OrdererType: etcdraft
EtcdRaft:
Consenters:
- Host: orderer.example.com
Port: 7050
ClientTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt
ServerTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt
- Host: orderer2.example.com
Port: 7050
ClientTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/server.crt
ServerTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer2.example.com/tls/server.crt
- Host: orderer3.example.com
Port: 7050
ClientTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/server.crt
ServerTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer3.example.com/tls/server.crt
- Host: orderer4.example.com
Port: 7050
ClientTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer4.example.com/tls/server.crt
ServerTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer4.example.com/tls/server.crt
- Host: orderer5.example.com
Port: 7050
ClientTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer5.example.com/tls/server.crt
ServerTLSCert: ./crypto-config/ordererOrganizations/example.com/orderers/orderer5.example.com/tls/server.crt
Addresses:
- orderer.example.com:7050
- orderer2.example.com:7050
- orderer3.example.com:7050
- orderer4.example.com:7050
- orderer5.example.com:7050
Organizations:
- *OrdererOrg
Capabilities:
<<: *OrdererCapabilities
Application:
<<: *ApplicationDefaults
Organizations:
- <<: *OrdererOrg
Consortiums:
SampleConsortium:
Organizations:
- *Org1
- *Org2
this is my host list:
|order.example.com|182.23.20.1|order|
|peer0.org1.example.com|182.23.20.2|org1|
|peer1.org1.example.com|182.23.20.3|org1|
|peer0.org2.example.com|182.23.20.4|org2|
|peer1.org2.example.com|182.23.20.5|org2|
So here's how I do it
Step one:Generate certificate file
cryptogen generate --config=./crypto-config.yaml
Step two:Create system channels
configtxgen -profile SampleMultiNodeEtcdRaft -outputBlock ../channel-artifacts/orderer.genesis.block -channelID system-channel
Step three:Create application channels
configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ../channel-artifacts/example-channel.tx -channelID example-channel
Step four:Anchor node update
configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ../channel-artifacts/Org1MSPanchors.tx -channelID example-channel -asOrg Org1MSP
configtxgen -profile TwoOrgsChannel -outputAnchorPeersUpdate ../channel-artifacts/Org2MSPanchors.tx -channelID example-channel -asOrg Org2MSP
Step five:Create channels on nodes ,on peer0.org1 nodes
peer channel create -o orderer.example.com:7050 -c example-channel \
-f ./channel-artifacts/example-channel.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
Step six : join channel and Anchor node update
peer channel join -b example-channel.block
#Anchor node update
peer channel update -o orderer.example.com:7050 -c example-channel -f ./channel-artifacts/Org1MSPanchors.tx --tls --cafile /opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem
This is true of other peer nodes
Step seven:chaincode manager,use fabcar
# 1:gradlew installDist
cd ~/go/src/github.com/hyperledger/example/chaincode/fabcar/java
./gradlew installDist
#2:chaincode package
peer lifecycle chaincode package mycc.tar.gz \
--path /opt/gopath/src/github.com/hyperledger/fabric/peer/chaincode/fabcar/java/build/install/fabcar \
--lang java --label mycc_1
#3:chaincode install
peer lifecycle chaincode install mycc.tar.gz
This is true for all other nodes
I tried using 'peer lifecycle chaincode queryinstalled'the command to execute on each peer and got the following results:
Installed chaincodes on peer:
Package ID: mycc_1:2499940fe909cc71a661bf79a3d78523a43c4d2879f4456e6cbe4a2a5a5e5246, Label: mycc_1
#4:chaincode approveformyorg
export CC_PACKAGE_ID=mycc_1:2499940fe909cc71a661bf79a3d78523a43c4d2879f4456e6cbe4a2a5a5e5246
# cafile path
export CF=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem
# cc_name
export CC_NAME=example-channel
peer lifecycle chaincode approveformyorg -o orderer.example.com:7050 \
--channelID $CC_NAME --name mycc --version 1.0 --package-id $CC_PACKAGE_ID --sequence 1 --tls \
--cafile $CF --signature-policy "OR('Org1MSP.peer', 'Org2MSP.peer')"
When I executed the command, there was an error:
Error: failed to send transaction: got unexpected status: NOT_FOUND -- channel does not exist
Finally, there are no error messages in any of the above procedures below the supplement!
Do you have a good solution,think you !!!
Please make sure that you follow all the steps to create the channel properly.
Those steps are:
create the channel transaction artifact using configtxgen
create the channel on network using "peer channel create" command
join the peer on that channel using "peer channel join"
Now when you will give the approval, make sure you use "--channelID" flag in approval time.
It seem to be an error caused by your Orderer Service. Although you define at your configuration file configtx.yaml that you will have 5 orderer nodes, in your logs you only show one: |order.example.com|182.23.20.1|order|. So, it seems that you are not startintg up all those 5 orderers. Have you checked your order.example.com logs?
However, you could try one (or both) of the following changes?
I think that you should try removing the configuration of the rest of the orderers from your configuration files, i.e. you only should have defined the orderer.example.com. Then, you should execute all the steps again. Remember removing the docker containers and volumes created previously.
The second test could be replicating the configuration of the orderer.example.com. You would try to recplicate the definition of the orderer.example.com. Because it seems that you are not defining and starting up the rest of the orderers that you should have running.

Adding custom Node OUs with Hyperledger Fabric

I am trying to add custom Node OU in policy definition inside the configtx.yaml file. The policy definition is present in Application section of configtx.yaml file as follows:
Application: &ApplicationDefaults
# Organizations is the list of orgs which are defined as participants on
# the application side of the network
ACLs: &ACLsDefault
peer/Propose: /Channel/Application/Checkous
Organizations:
# Policies defines the set of policies at this level of the config tree
# For Application policies, their canonical path is
# /Channel/Application/<PolicyName>
Policies:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
Checkous:
Type: Signature
Rule: "OR('Org1MSP.admin', 'Org1MSP.client', 'Org1MSP.dept')"
Capabilities:
<<: *ApplicationCapabilities
I already generated the crypto-material using cryptogen tool. As you can see I am also using the custom policy inside one of the ACLs.
Next, I created the orderer genesis block.
##########################################################
######### Generating Orderer Genesis block ##############
##########################################################
CONSENSUS_TYPE=solo
+ '[' solo == solo ']'
+ configtxgen -profile TwoOrgsOrdererGenesis -channelID byfn-sys-channel -outputBlock ./channel-artifacts/genesis.block
2020-02-17 05:17:01.991 UTC [common.tools.configtxgen] main -> INFO 001 Loading configuration
2020-02-17 05:17:02.150 UTC [common.tools.configtxgen.localconfig] completeInitialization -> INFO 002 orderer type: solo
2020-02-17 05:17:02.150 UTC [common.tools.configtxgen.localconfig] Load -> INFO 003 Loaded configuration: /home/chintanr11/fabric-samples/first-network/configtx.yaml
2020-02-17 05:17:02.309 UTC [common.tools.configtxgen.localconfig] completeInitialization -> INFO 004 orderer type: solo
2020-02-17 05:17:02.309 UTC [common.tools.configtxgen.localconfig] LoadTopLevel -> INFO 005 Loaded configuration: /home/chintanr11/fabric-samples/first-network/configtx.yaml
2020-02-17 05:17:02.311 UTC [common.tools.configtxgen] doOutputBlock -> INFO 006 Generating genesis block
2020-02-17 05:17:02.311 UTC [common.tools.configtxgen] doOutputBlock -> INFO 007 Writing genesis block
+ res=0
+ set +x
Followed by which, when I try to create channel configuration block, I receive the following error:
#################################################################
### Generating channel configuration transaction 'channel.tx' ###
#################################################################
+ configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/channel.tx -channelID mychannel
2020-02-17 05:17:02.346 UTC [common.tools.configtxgen] main -> INFO 001 Loading configuration
2020-02-17 05:17:02.518 UTC [common.tools.configtxgen.localconfig] Load -> INFO 002 Loaded configuration: /home/chintanr11/fabric-samples/first-network/configtx.yaml
2020-02-17 05:17:02.680 UTC [common.tools.configtxgen.localconfig] completeInitialization -> INFO 003 orderer type: solo
2020-02-17 05:17:02.680 UTC [common.tools.configtxgen.localconfig] LoadTopLevel -> INFO 004 Loaded configuration: /home/chintanr11/fabric-samples/first-network/configtx.yaml
2020-02-17 05:17:02.680 UTC [common.tools.configtxgen] doOutputChannelCreateTx -> INFO 005 Generating new channel configtx
2020-02-17 05:17:02.680 UTC [common.tools.configtxgen] main -> FATA 006 Error on outputChannelCreateTx: could not generate default config template: error parsing configuration: could not create application group: error adding policies to application group: invalid signature policy rule 'OR('Org1MSP.admin', 'Org1MSP.client', 'Org1MSP.dept')': Unable to parse numeric value '.' to float64
+ res=1
+ set +x
Failed to generate channel configuration transaction...
NOTE: I have added the definition for this OU in my config.yaml file located at: ~/fabric-samples/first-network/crypto-config/peerOrganizations/org1.example.com/msp. The file looks as follows:
NodeOUs:
Enable: true
ClientOUIdentifier:
Certificate: cacerts/ca.org1.example.com-cert.pem
OrganizationalUnitIdentifier: client
PeerOUIdentifier:
Certificate: cacerts/ca.org1.example.com-cert.pem
OrganizationalUnitIdentifier: peer
AdminOUIdentifier:
Certificate: cacerts/ca.org1.example.com-cert.pem
OrganizationalUnitIdentifier: admin
OrdererOUIdentifier:
Certificate: cacerts/ca.org1.example.com-cert.pem
OrganizationalUnitIdentifier: orderer
DeptOUIdentifier:
Certificate: cacerts/ca.org1.example.com-cert.pem
OrganizationalUnitIdentifier: dept
What does the above error in channel block creation mean and any solution to resolve it?
How to possibly use custom Node OUs in the network using Fabric CA (and not cryptogen)?
You cannot use "custom" NodeOU identifiers. Fabric policies only support the following roles:
$MSPID.admin
$MSPID.member
$MSPID.peer
$MSPID.client
$MSPID.orderer
This means you can only use the built-in Node OU identifiers:
ClientOUIdentifier
PeerOUIdentifier
AdminOUIdentifier
OrdererOUIdentifier

Unable to spinup orderers in Raft consensus in hyperledger Fabric

I am extending the first network example with raft consensus on multiple hosts. When I try to start the orderers, the first orderer starts up but, I can not start any other orderers from both the same organisation and other organisation. The error I get as follows
[common.deliver] deliverBlocks -> WARN 019 [channel:
orderersyschannel] Client authorization revoked for deliver request
from 172.18.0.5:45506: implicit policy evaluation failed - 0
sub-policies were satisfied, but this policy requires 1 of the
'Readers' sub-policies to be satisfied: permission denied 2019-09-23
07:22:52.937 UTC [comm.grpc.server] 1 -> INFO 01a streaming call
completed grpc.service=orderer.AtomicBroadcast grpc.method=Deliver
grpc.peer_address=172.18.0.5 :45506
grpc.peer_subject="CN=ord1-org2,OU=orderer,O=Hyperledger,ST=North
Carolina,C=US" grpc.code=OK grpc.call_duration=1.590709ms
2019-09-23 07:22:52.945 UTC [orderer.common.cluster.replication]
fetchLastBlockSeq -> WARN 01b Received status:FORBIDDEN from
ord1-org2.local:7050: forbidden pullin g the channel
2019-09-23 07:22:52.945 UTC [orderer.common.cluster.replication] func1
-> WARN 01c Received error of type 'forbidden pulling the channel' from {ord1-org2.local:7050
I also checked my policies in 'configtx.yaml'
In Organisations section:
Readers:
Type: Signature
Rule: "OR('org2MSP.member', 'org2MSP.admin', 'org2MSP.peer', 'org2MSP.client')"
Writers:
Type: Signature
Rule: "OR('org2MSP.member', 'org2MSP.admin', 'org2MSP.client')"
Admins:
Type: Signature
Rule: "OR('org2MSP.admin')"
in Orderer section I have:
Readers:
Type: ImplicitMeta
Rule: "ANY Readers"
Writers:
Type: ImplicitMeta
Rule: "ANY Writers"
Admins:
Type: ImplicitMeta
Rule: "MAJORITY Admins"
# BlockValidation specifies what signatures must be included in the block
# from the orderer for the peer to validate it.
BlockValidation:
Type: ImplicitMeta
Rule: "ANY Writers"
I am not sure why the policies or not met. Can anyone help me troubleshoot this?
Try by editing this block in your configtx.yaml file and regenerate genesis block.
Profiles:
TwoOrgsOrdererGenesis:
<<: *ChannelDefaults
Orderer:
<<: *OrdererDefaults
Organizations:
- *Org1
**- *Org2**
Capabilities:
<<: *OrdererCapabilities
Consortiums:
SampleConsortium:
Organizations:
- *Org1
- *Org2

Got an error while running first-network example, fabric version 1.2

Env related :
Mac OS High Sierra(version 10.13.6)
Docker version 18.06.1-ce
fabric version 1.2.0 (installed by this command :
curl https://raw.githubusercontent.com/hyperledger/fabric/master/scripts/bootstrap.sh |bash -s 1.2.0)
You will see that there is an err after calling
./byfn.sh up
Log follows:
2018-09-04 02:37:21.047 UTC [chaincodeCmd] checkChaincodeCmdParams -> INFO 001 Using default escc
2018-09-04 02:37:21.047 UTC [chaincodeCmd] checkChaincodeCmdParams -> INFO 002 Using default vscc
Error: could not assemble transaction, err Proposal response was not successful, error code 500, msg failed to execute transaction fc42719a6fc35ab6fbd661c80735003b55bf9d3a0d451875fbdc949dc40d05e6: error starting container: error starting container: Get https://registry-1.docker.io/v2/: net/http: TLS handshake timeout
!!!!!!!!!!!!!!! Chaincode instantiation on peer0.org2 on channel 'mychannel' failed !!!!!!!!!!!!!!!!
========= ERROR !!! FAILED to execute End-2-End Scenario ===========
ERROR !!!! Test failed
before that, when I called ./byfn.sh generate, also got some warnings which is not compatable as the tutorial https://hyperledger-fabric.readthedocs.io/en/release-1.2/build_network.html:
/Users/isme/Desktop/hpfbric/fabric-samples/first-network/../bin/configtxgen
##########################################################
######### Generating Orderer Genesis block ##############
##########################################################
+ configtxgen -profile TwoOrgsOrdererGenesis -outputBlock ./channel-artifacts/genesis.block
2018-09-04 10:23:17.293 CST [common/tools/configtxgen] main -> WARN 001 Omitting the channel ID for configtxgen is deprecated. Explicitly passing the channel ID will be required in the future, defaulting to 'testchainid'.
2018-09-04 10:23:17.293 CST [common/tools/configtxgen] main -> INFO 002 Loading configuration
2018-09-04 10:23:17.298 CST [common/tools/configtxgen/encoder] NewChannelGroup -> WARN 003 Default policy emission is deprecated, please include policy specificiations for the channel group in configtx.yaml
2018-09-04 10:23:17.298 CST [common/tools/configtxgen/encoder] NewOrdererGroup -> WARN 004 Default policy emission is deprecated, please include policy specificiations for the orderer group in configtx.yaml
2018-09-04 10:23:17.298 CST [common/tools/configtxgen/encoder] NewOrdererOrgGroup -> WARN 005 Default policy emission is deprecated, please include policy specificiations for the orderer org group OrdererOrg in configtx.yaml
2018-09-04 10:23:17.298 CST [msp] getMspConfig -> INFO 006 Loading NodeOUs
2018-09-04 10:23:17.298 CST [common/tools/configtxgen/encoder] NewOrdererOrgGroup -> WARN 007 Default policy emission is deprecated, please include policy specificiations for the orderer org group Org1MSP in configtx.yaml
2018-09-04 10:23:17.299 CST [msp] getMspConfig -> INFO 008 Loading NodeOUs
2018-09-04 10:23:17.299 CST [common/tools/configtxgen/encoder] NewOrdererOrgGroup -> WARN 009 Default policy emission is deprecated, please include policy specificiations for the orderer org group Org2MSP in configtx.yaml
2018-09-04 10:23:17.299 CST [common/tools/configtxgen] doOutputBlock -> INFO 00a Generating genesis block
2018-09-04 10:23:17.300 CST [common/tools/configtxgen] doOutputBlock -> INFO 00b Writing genesis block
+ res=0
+ set +x
#################################################################
### Generating channel configuration transaction 'channel.tx' ###
#################################################################
+ configtxgen -profile TwoOrgsChannel -outputCreateChannelTx ./channel-artifacts/channel.tx -channelID mychannel
2018-09-04 10:23:17.325 CST [common/tools/configtxgen] main -> INFO 001 Loading configuration
2018-09-04 10:23:17.330 CST [common/tools/configtxgen] doOutputChannelCreateTx -> INFO 002 Generating new channel configtx
2018-09-04 10:23:17.330 CST [common/tools/configtxgen/encoder] NewApplicationGroup -> WARN 003 Default policy emission is deprecated, please include policy specificiations for the application group in configtx.yaml
2018-09-04 10:23:17.330 CST [msp] getMspConfig -> INFO 004 Loading NodeOUs
2018-09-04 10:23:17.330 CST [common/tools/configtxgen/encoder] NewApplicationOrgGroup -> WARN 005 Default policy emission is deprecated, please include policy specificiations for the application org group Org1MSP in configtx.yaml
2018-09-04 10:23:17.330 CST [msp] getMspConfig -> INFO 006 Loading NodeOUs
2018-09-04 10:23:17.331 CST [common/tools/configtxgen/encoder] NewApplicationOrgGroup -> WARN 007 Default policy emission is deprecated, please include policy specificiations for the application org group Org2MSP in configtx.yaml
2018-09-04 10:23:17.331 CST [common/tools/configtxgen] doOutputChannelCreateTx -> INFO 008 Writing new channel tx
+ res=0
+ set +x

Resources