From ef871b9bac428cdc6b3a47128c75a0fd5f9c6a19 Mon Sep 17 00:00:00 2001 From: Aditya Joshi Date: Tue, 9 Jan 2024 11:22:38 +0530 Subject: [PATCH] added sample for certifiate renewal in test-network Signed-off-by: Aditya Joshi --- test-network/network.sh | 21 +++ .../organizations/fabric-ca/reEnroll.sh | 157 ++++++++++++++++++ test-network/scripts/utils.sh | 1 + 3 files changed, 179 insertions(+) create mode 100644 test-network/organizations/fabric-ca/reEnroll.sh diff --git a/test-network/network.sh b/test-network/network.sh index 9739a68b18..0aa0caf190 100755 --- a/test-network/network.sh +++ b/test-network/network.sh @@ -414,6 +414,25 @@ function queryChaincode() { } +function renewCerts(){ + . ./organizations/fabric-ca/reEnroll.sh + + rm "${PWD}"/organizations/fabric-ca/ordererOrg/tls-cert.pem + docker restart ca_orderer + sleep 10 + reEnrollOrderer + + rm "${PWD}"/organizations/fabric-ca/org1/tls-cert.pem + docker restart ca_org1 + sleep 10 + reEnrollOrg1 + + rm "${PWD}"/organizations/fabric-ca/org2/tls-cert.pem + docker restart ca_org2 + sleep 10 + reEnrollOrg2 +} + # Tear down running network function networkDown() { @@ -668,6 +687,8 @@ elif [ "$MODE" == "cc" ] && [ "$SUBCOMMAND" == "invoke" ]; then invokeChaincode elif [ "$MODE" == "cc" ] && [ "$SUBCOMMAND" == "query" ]; then queryChaincode +elif [ "$MODE" == "renewCerts" ]; then + renewCerts else printHelp exit 1 diff --git a/test-network/organizations/fabric-ca/reEnroll.sh b/test-network/organizations/fabric-ca/reEnroll.sh new file mode 100644 index 0000000000..4175a689ba --- /dev/null +++ b/test-network/organizations/fabric-ca/reEnroll.sh @@ -0,0 +1,157 @@ +#!/bin/bash + +function reEnrollOrg1() { + infoln "Re-enrolling the CA admin" + mkdir -p organizations/peerOrganizations/org1.example.com/ + + export FABRIC_CA_CLIENT_HOME=${PWD}/organizations/peerOrganizations/org1.example.com/ + + set -x + fabric-ca-client reenroll -u https://admin:adminpw@localhost:7054 --caname ca-org1 --tls.certfiles "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + # Copy org1's CA cert to org1's /msp/tlscacerts directory (for use in the channel MSP definition) + mkdir -p "${PWD}/organizations/peerOrganizations/org1.example.com/msp/tlscacerts" + cp "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" "${PWD}/organizations/peerOrganizations/org1.example.com/msp/tlscacerts/ca.crt" + + # Copy org1's CA cert to org1's /tlsca directory (for use by clients) + mkdir -p "${PWD}/organizations/peerOrganizations/org1.example.com/tlsca" + cp "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" "${PWD}/organizations/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem" + + # Copy org1's CA cert to org1's /ca directory (for use by clients) + mkdir -p "${PWD}/organizations/peerOrganizations/org1.example.com/ca" + cp "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" "${PWD}/organizations/peerOrganizations/org1.example.com/ca/ca.org1.example.com-cert.pem" + + + infoln "Generating the peer0 msp" + set -x + fabric-ca-client reenroll -u https://peer0:peer0pw@localhost:7054 --caname ca-org1 -M "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp" --csr.hosts peer0.org1.example.com --tls.certfiles "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml" "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp/config.yaml" + + infoln "Generating the peer0-tls certificates" + set -x + fabric-ca-client reenroll -u https://peer0:peer0pw@localhost:7054 --caname ca-org1 -M "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls" --enrollment.profile tls --csr.hosts peer0.org1.example.com --csr.hosts localhost --tls.certfiles "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + # Copy the tls CA cert, server cert, server keystore to well known file names in the peer's tls directory that are referenced by peer startup config + cp "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/tlscacerts/"* "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt" + cp "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/signcerts/"* "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt" + cp "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/keystore/"* "${PWD}/organizations/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key" + + infoln "Generating the user msp" + set -x + fabric-ca-client reenroll -u https://user1:user1pw@localhost:7054 --caname ca-org1 -M "${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/msp" --tls.certfiles "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml" "${PWD}/organizations/peerOrganizations/org1.example.com/users/User1@org1.example.com/msp/config.yaml" + + infoln "Generating the org admin msp" + set -x + fabric-ca-client reenroll -u https://org1admin:org1adminpw@localhost:7054 --caname ca-org1 -M "${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp" --tls.certfiles "${PWD}/organizations/fabric-ca/org1/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/peerOrganizations/org1.example.com/msp/config.yaml" "${PWD}/organizations/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp/config.yaml" +} + +function reEnrollOrg2() { + infoln "Re-enrolling the CA admin" + mkdir -p organizations/peerOrganizations/org2.example.com/ + + export FABRIC_CA_CLIENT_HOME=${PWD}/organizations/peerOrganizations/org2.example.com/ + + set -x + fabric-ca-client reenroll -u https://admin:adminpw@localhost:8054 --caname ca-org2 --tls.certfiles "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + # Copy org2's CA cert to org2's /msp/tlscacerts directory (for use in the channel MSP definition) + mkdir -p "${PWD}/organizations/peerOrganizations/org2.example.com/msp/tlscacerts" + cp "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" "${PWD}/organizations/peerOrganizations/org2.example.com/msp/tlscacerts/ca.crt" + + # Copy org2's CA cert to org2's /tlsca directory (for use by clients) + mkdir -p "${PWD}/organizations/peerOrganizations/org2.example.com/tlsca" + cp "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" "${PWD}/organizations/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem" + + # Copy org2's CA cert to org2's /ca directory (for use by clients) + mkdir -p "${PWD}/organizations/peerOrganizations/org2.example.com/ca" + cp "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" "${PWD}/organizations/peerOrganizations/org2.example.com/ca/ca.org2.example.com-cert.pem" + + infoln "Generating the peer0 msp" + set -x + fabric-ca-client reenroll -u https://peer0:peer0pw@localhost:8054 --caname ca-org2 -M "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp" --csr.hosts peer0.org2.example.com --tls.certfiles "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml" "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/msp/config.yaml" + + infoln "Generating the peer0-tls certificates" + set -x + fabric-ca-client reenroll -u https://peer0:peer0pw@localhost:8054 --caname ca-org2 -M "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls" --enrollment.profile tls --csr.hosts peer0.org2.example.com --csr.hosts localhost --tls.certfiles "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + # Copy the tls CA cert, server cert, server keystore to well known file names in the peer's tls directory that are referenced by peer startup config + cp "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/tlscacerts/"* "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/ca.crt" + cp "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/signcerts/"* "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.crt" + cp "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/keystore/"* "${PWD}/organizations/peerOrganizations/org2.example.com/peers/peer0.org2.example.com/tls/server.key" + + infoln "Generating the user msp" + set -x + fabric-ca-client reenroll -u https://user1:user1pw@localhost:8054 --caname ca-org2 -M "${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/msp" --tls.certfiles "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml" "${PWD}/organizations/peerOrganizations/org2.example.com/users/User1@org2.example.com/msp/config.yaml" + + infoln "Generating the org admin msp" + set -x + fabric-ca-client reenroll -u https://org2admin:org2adminpw@localhost:8054 --caname ca-org2 -M "${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp" --tls.certfiles "${PWD}/organizations/fabric-ca/org2/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/peerOrganizations/org2.example.com/msp/config.yaml" "${PWD}/organizations/peerOrganizations/org2.example.com/users/Admin@org2.example.com/msp/config.yaml" +} + +function reEnrollOrderer() { + infoln "Re-enrolling the CA admin" + mkdir -p organizations/ordererOrganizations/example.com + + export FABRIC_CA_CLIENT_HOME=${PWD}/organizations/ordererOrganizations/example.com + + set -x + fabric-ca-client reenroll -u https://admin:adminpw@localhost:9054 --caname ca-orderer --tls.certfiles "${PWD}/organizations/fabric-ca/ordererOrg/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + # Copy orderer org's CA cert to orderer org's /msp/tlscacerts directory (for use in the channel MSP definition) + mkdir -p "${PWD}/organizations/ordererOrganizations/example.com/msp/tlscacerts" + cp "${PWD}/organizations/fabric-ca/ordererOrg/ca-cert.pem" "${PWD}/organizations/ordererOrganizations/example.com/msp/tlscacerts/tlsca.example.com-cert.pem" + + # Copy orderer org's CA cert to orderer org's /tlsca directory (for use by clients) + mkdir -p "${PWD}/organizations/ordererOrganizations/example.com/tlsca" + cp "${PWD}/organizations/fabric-ca/ordererOrg/ca-cert.pem" "${PWD}/organizations/ordererOrganizations/example.com/tlsca/tlsca.example.com-cert.pem" + + infoln "Generating the orderer msp" + set -x + fabric-ca-client reenroll -u https://orderer:ordererpw@localhost:9054 --caname ca-orderer -M "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp" --csr.hosts orderer.example.com --csr.hosts localhost --tls.certfiles "${PWD}/organizations/fabric-ca/ordererOrg/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml" "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/config.yaml" + + infoln "Generating the orderer-tls certificates" + set -x + fabric-ca-client reenroll -u https://orderer:ordererpw@localhost:9054 --caname ca-orderer -M "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls" --enrollment.profile tls --csr.hosts orderer.example.com --csr.hosts localhost --tls.certfiles "${PWD}/organizations/fabric-ca/ordererOrg/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + # Copy the tls CA cert, server cert, server keystore to well known file names in the orderer's tls directory that are referenced by orderer startup config + cp "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/tlscacerts/"* "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/ca.crt" + cp "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/signcerts/"* "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.crt" + cp "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/keystore/"* "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/server.key" + + # Copy orderer org's CA cert to orderer's /msp/tlscacerts directory (for use in the orderer MSP definition) + mkdir -p "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts" + cp "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/tls/tlscacerts/"* "${PWD}/organizations/ordererOrganizations/example.com/orderers/orderer.example.com/msp/tlscacerts/tlsca.example.com-cert.pem" + + infoln "Generating the admin msp" + set -x + fabric-ca-client reenroll -u https://ordererAdmin:ordererAdminpw@localhost:9054 --caname ca-orderer -M "${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/msp" --tls.certfiles "${PWD}/organizations/fabric-ca/ordererOrg/ca-cert.pem" --csr.keyrequest.reusekey + { set +x; } 2>/dev/null + + cp "${PWD}/organizations/ordererOrganizations/example.com/msp/config.yaml" "${PWD}/organizations/ordererOrganizations/example.com/users/Admin@example.com/msp/config.yaml" +} diff --git a/test-network/scripts/utils.sh b/test-network/scripts/utils.sh index 73db6efb89..1c6b0a10d3 100755 --- a/test-network/scripts/utils.sh +++ b/test-network/scripts/utils.sh @@ -198,6 +198,7 @@ function printHelp() { println " network.sh createChannel -c channelName" println " network.sh deployCC -ccn basic -ccp ../asset-transfer-basic/chaincode-javascript/ -ccl javascript" println " network.sh deployCC -ccn mychaincode -ccp ./user/mychaincode -ccv 1 -ccl javascript" + println " network.sh renewCerts" println println " NOTE: Default settings can be changed in network.config" fi