【问题标题】:peer channel creation fails in Hyperledger FabricHyperledger Fabric 中的对等通道创建失败
【发布时间】:2018-01-25 08:42:21
【问题描述】:

我正在尝试设置一个示例超级账本结构环境,其中包含一个排序节点和 2 个对等节点。我没有使用 docker 方法,而是运行实际的可执行文件本身。

Orderer 和 2 个 peer 节点启动成功。但是,频道创建失败并出现以下错误。任何帮助将不胜感激。

订购窗口出错

> 2017-08-17 07:28:22.338 IST [orderer/common/deliver] Handle -> WARN
> 029 Error reading from stream: rpc error: code = Canceled desc =
> context canceled 2017-08-17 07:31:08.044 IST [common/config/channel]
> CommitProposals -> WARN 02a Current configuration has no policy
> '/Channel/Application/Readers', this will likely cause problems in
> production systems 2017-08-17 07:31:08.050 IST [common/config/channel]
> CommitProposals -> WARN 02b Current configuration has no policy
> '/Channel/Application/Writers', this will likely cause problems in
> production systems 2017-08-17 07:31:08.050 IST [common/config/channel]
> CommitProposals -> WARN 02c Current configuration has no policy
> '/Channel/Application/Admins', this will likely cause problems in
> production systems 2017-08-17 07:31:08.051 IST [cauthdsl] func2 ->
> ERRO 02d Principal deserialization failure (The supplied identity is
> not valid, Verify() returned x509: certificate signed by unknown
> authority) for identity
> 0a07506565724f726712e7052d2d2d2d2d424547494e202d2d2d2d2d0a4d494943427a43434161326741774942416749514e303434797750356c6d6c3477613379723836355a6a414b42676771686b6a4f50515144416a426e4d5173770a435159445651514745774a56557a45544d4245474131554543424d4b5132467361575a76636d3570595445574d4251474131554542784d4e5532467549455a790a5957356a61584e6a627a45544d4245474131554543684d4b593246795a6d46344c6d4e76625445574d4251474131554541784d4e59324575593246795a6d46340a4c6d4e7662544165467730784e7a41344d5459784e7a41344e445261467730794e7a41344d5451784e7a41344e4452614d465578437a414a42674e56424159540a416c56544d524d77455159445651514945777044595778705a6d3979626d6c684d52597746415944565151484577315459573467526e4a68626d4e7063324e760a4d526b774677594456515144444242425a473170626b426a59584a6d59586775593239744d466b77457759484b6f5a497a6a3043415159494b6f5a497a6a30440a4151634451674145743046756e6d577635336b6366417846785953784c44565164324d336b6d586345714b556c77507a6a444a544b626c4265317931376b39380a4c64384f2f57374c777a71394b374f563957394a3765367962736b44324b4e4e4d45737744675944565230504151482f42415144416765414d417747413155640a457745422f7751434d4141774b7759445652306a42435177496f4167445a62512f58784241523253396670326b64587a78546a666c35685055724958376635460a664d446d6b4f7377436759494b6f5a497a6a304541774944534141775251496841507a303051514962515769727a467962357978736a3168384d6a316a37482b0a333971735171445438387a684169426a6776705a777675764947456b6a624a75697663574b3172476f36416b314430362f7445527a59383538513d3d0a2d2d2d2d2d454e44202d2d2d2d2d0a
> 2017-08-17 07:31:08.052 IST [orderer/common/broadcast] Handle -> WARN
> 02e [channel: testing] Rejecting broadcast of config message because
> of error: Error authorizing update: Error validating DeltaSet: Policy
> for [Groups] /Channel/Application not satisfied: Failed to reach
> implicit threshold of 1 sub-policies, required 1 remaining 2017-08-17
> 07:31:08.063 IST [orderer/common/deliver] Handle -> WARN 02f Error
> reading from stream: rpc error: code = Canceled desc = context
> canceled

ORDERER_TLS 的值

ORDERER_TLS="--tls true--cafile /opt/gopath/src/github.com/hyperledger/fabric/sampleconfig/tls/ca.crt"

创建频道时出错

node1@ubuntu:/opt/gopath/src/github.com/hyperledger/fabric/build/bin$ peer channel create $ORDERER_TLS -f /home/node1/Downloads/fabricDeployment-master/testing.tx -c testing -o node1.honda.com:7050 --logging-level DEBUG  -v
2017-08-17 07:28:21.953 IST [msp] GetLocalMSP -> DEBU 001 Returning existing local MSP
2017-08-17 07:28:21.953 IST [msp] GetDefaultSigningIdentity -> DEBU 002 Obtaining default signing identity
2017-08-17 07:28:21.996 IST [channelCmd] InitCmdFactory -> INFO 003 Endorser and orderer connections initialized
2017-08-17 07:28:22.014 IST [msp] GetLocalMSP -> DEBU 004 Returning existing local MSP
2017-08-17 07:28:22.019 IST [msp] GetDefaultSigningIdentity -> DEBU 005 Obtaining default signing identity
2017-08-17 07:28:22.019 IST [msp] GetLocalMSP -> DEBU 006 Returning existing local MSP
2017-08-17 07:28:22.019 IST [msp] GetDefaultSigningIdentity -> DEBU 007 Obtaining default signing identity
2017-08-17 07:28:22.019 IST [msp/identity] Sign -> DEBU 008 Sign: plaintext: 0AF3050A07506565724F726712E7052D...69636174696F6E2F41646D696E731801 
2017-08-17 07:28:22.019 IST [msp/identity] Sign -> DEBU 009 Sign: digest: 63EBD4B3B350685B39A0C8E8E216EFCB3D4C3C82F74B6FA2638D2A7974EB1E74 
2017-08-17 07:28:22.020 IST [msp] GetLocalMSP -> DEBU 00a Returning existing local MSP
2017-08-17 07:28:22.020 IST [msp] GetDefaultSigningIdentity -> DEBU 00b Obtaining default signing identity
2017-08-17 07:28:22.020 IST [msp] GetLocalMSP -> DEBU 00c Returning existing local MSP
2017-08-17 07:28:22.020 IST [msp] GetDefaultSigningIdentity -> DEBU 00d Obtaining default signing identity
2017-08-17 07:28:22.020 IST [msp/identity] Sign -> DEBU 00e Sign: plaintext: 0AA6060A1108021A0608BEF0D3CC0522...1A843140B4B661FA8CBCB3170133AC2B 
2017-08-17 07:28:22.020 IST [msp/identity] Sign -> DEBU 00f Sign: digest: EB039E58FB665150B556394FD464155BBB349CEBB591A578DE402789465EDA84 
Error: Got unexpected status: BAD_REQUEST -- Error authorizing update: Error validating DeltaSet: Policy for [Groups] /Channel/Application not satisfied: Failed to reach implicit threshold of 1 sub-policies, required 1 remaining
Usage:
  peer channel create [flags]

Flags:
  -c, --channelID string   In case of a newChain command, the channel ID to create.
  -f, --file string        Configuration transaction file generated by a tool such as configtxgen for submitting to orderer
  -t, --timeout int        Channel creation timeout (default 5)

Global Flags:
      --cafile string                       Path to file containing PEM-encoded trusted certificate(s) for the ordering endpoint
      --logging-level string                Default logging level and overrides, see core.yaml for full syntax
  -o, --orderer string                      Ordering service endpoint
      --ordererTLSHostnameOverride string   The hostname override to use when validating the TLS connection to the orderer.
      --test.coverprofile string            Done (default "coverage.cov")
      --tls                                 Use TLS when communicating with the orderer endpoint
  -v, --version                             Display current version of fabric peer server

编辑开始

感谢您的回复 Yacovm。我仍然面临同样的问题。 事实上,我正在使用你的 github 代码来尝试这个示例。该脚本很棒且易于理解

让我简要介绍一下我目前的设置。

环境 运行 3 个节点 - Ubuntu 16

> **Node1 Details** Hostname : node1 Domain name : honda.com User1 : node1 User2 : Admin
> 
> **Node2 Details** Hostname : node2 Domain name : carfax.com User1 : node2 User2 : Admin
> 
> **Node3 Details** Hostname : node3 Domain name : carfax.com User1 : node3 User2 : Admin

第 1 步: 在所有 3 台机器上下载了 Fabric 源代码并运行“make”——一切都成功了

源位于以下路径中:/opt/gopath/src/github.com/hyperledger/fabric

第 2 步:

在node1机器上下载fabricDeployment-master /home/node1/Downloads/fabricDeployment-master 从 node1 机器, 我正在运行以下命令(我使用的是 github 中提供的 deploy.sh 稍作改动)

[[ -z $GOPATH ]] && (echo "Environment variable GOPATH isn't set!"; exit 1)
FABRIC=$GOPATH/src/github.com/hyperledger/fabric
[[ -d "$FABRIC" ]] || (echo "Directory $FABRIC doesn't exist!"; exit 1)
for file in configtxgen peer cryptogen; do
    [[ -f $file ]] && continue
    binary=$FABRIC/build/bin/$file
    [[ ! -f $binary ]] && ( cd $FABRIC ; make $file)
    cp $binary $file && continue
done

for file in configtxgen peer cryptogen; do
    [[ ! -f $file ]] && echo "$file isn't found, aborting!" && exit 1
done

. config.sh

bootPeer=$(echo ${peers} | awk '{print $1}')
anchorPeer=$(echo ${peers} | awk '{print $1}')
PROPAGATEPEERNUM=${PROPAGATEPEERNUM:-3}
i=0
for p in $orderer $peers ; do

        echo "Making Directory structure for $p"
        mkdir -p $p/sampleconfig/crypto
        mkdir -p $p/sampleconfig/tls
        ip=$(getIP $p)
        echo "${p}'s ip address is ${ip}"
        orgLeader=false
        bootstrap=$anchorPeer:7051
        if [[ $i -eq 1 ]];then
                orgLeader=true
        fi
        (( i += 1 ))
        echo "Creating core.yaml from core.yaml.template for $p"
        cat core.yaml.template | sed "s/PROPAGATEPEERNUM/${PROPAGATEPEERNUM}/ ; s/PEERID/$p/ ; s/ADDRESS/$p/ ; s/ORGLEADER/$orgLeader/ ; s/BOOTSTRAP/$bootPeer:7051/ ; s/TLS_CERT/$p.carfax.com-cert.pem/" > $p/sampleconfig/core.yaml
done

        echo "Creating configtx.yaml from configtx.yaml.template with ANCHOR_PEER_IP & ORDERER_IP"

cat configtx.yaml.template | sed "s/ANCHOR_PEER_IP/$anchorpeer/ ; s/ORDERER_IP/$orderer/" > configtx.yaml


        echo "Creating crypto-config.yml from crypto-config.yml.template with ORDERER_IP and adding hostname node2 & node3"


cat crypto-config.yml.template | sed "s/ORDERER_IP/$orderer/" > crypto-config.yml
for p in $peers ; do
    echo "        - Hostname: $p" >> crypto-config.yml
done
cat << EOF >> crypto-config.yml
    Users:
      Count: 1
EOF

./cryptogen generate --config crypto-config.yml
./configtxgen -profile Genesis -outputBlock genesis.block  -channelID system
./configtxgen -profile Channels -outputCreateChannelTx yacov.tx -channelID yacov
./configtxgen -profile Channels -outputAnchorPeersUpdate OrdererOrganchors.tx -channelID yacov -asOrg PeerOrg

mv genesis.block node1/sampleconfig/
cp orderer.yaml node1/sampleconfig/
cp -r crypto-config/ordererOrganizations/honda.com/orderers/node1.honda.com/msp/* node1/sampleconfig/crypto
cp -r crypto-config/ordererOrganizations/honda.com/orderers/node1.honda.com/tls/* node1/sampleconfig/tls

cp -r crypto-config/peerOrganizations/carfax.com/peers/node2.carfax.com/msp/* node2/sampleconfig/crypto
cp -r crypto-config/peerOrganizations/carfax.com/peers/node2.carfax.com/tls/* node2/sampleconfig/tls/

cp -r crypto-config/peerOrganizations/carfax.com/peers/node3.carfax.com/msp/* node3/sampleconfig/crypto
cp -r crypto-config/peerOrganizations/carfax.com/peers/node3.carfax.com/tls/* node3/sampleconfig/tls/

echo "Deploying configuration - Moving configurations to respective machines"
scp -r node1/sampleconfig/* node1@node1:/opt/gopath/src/github.com/hyperledger/fabric/sampleconfig/
scp -r node2/sampleconfig/* node2@node2:/opt/gopath/src/github.com/hyperledger/fabric/sampleconfig/
scp -r node3/sampleconfig/* node3@node3:/opt/gopath/src/github.com/hyperledger/fabric/sampleconfig/

第 3 步:

生成的 crypto-config.yaml

OrdererOrgs:
  - Name: Org0
    Domain: honda.com
PeerOrgs:
  - Name: Org1
    Domain: carfax.com
        - Hostname: node2
        - Hostname: node3
    Users:
      Count: 1

Resulting crypto-config.yaml
Profiles:
    Genesis:
        Orderer:
            <<: *OrdererDefaults
            Organizations:
                - *OrdererOrg
        Consortiums:
             SampleConsortium:
                Organizations:
                - *PeerOrg
    Channels:
        Consortium: SampleConsortium
        Application:
            <<: *ApplicationDefaults
            Organizations:
                - *PeerOrg
Organizations:
    - &OrdererOrg
        Name: OrdererOrg
        ID: OrdererOrg
        MSPDir: crypto-config/ordererOrganizations/honda.com/msp
        AdminPrincipal: Role.ADMIN
    - &PeerOrg
        Name: PeerOrg
        ID: PeerOrg
        MSPDir: crypto-config/peerOrganizations/carfax.com/msp
        AdminPrincipal: Role.ADMIN

        AnchorPeers:
            - Host: node2
              Port: 7051

Orderer: &OrdererDefaults

    OrdererType: solo
    Addresses:
        - node1:7050
    BatchTimeout: 1ms
    BatchSize:
        MaxMessageCount: 10
        AbsoluteMaxBytes: 99 MB
        PreferredMaxBytes: 512 KB

    MaxChannels: 0

    Kafka:
        Brokers:
            - 127.0.0.1:9092

    Organizations:

Application: &ApplicationDefault

s

第 4 步: 以 node1 用户身份从 node1 启动 orderer 以 node2 用户身份从 node2 启动 peer1 以 node3 用户身份从 node3 启动 peer2

到这里一切正常

第 5 步:创建频道

从 node1 作为 node1 用户,运行以下命令

node1@ubuntu:~/Downloads/fabricDeployment-master$ pwd

/home/node1/Downloads/fabricDeployment-master

export FABRIC=$GOPATH/src/github.com/hyperledger/fabric
export ORDERER_TLS="--tls true --cafile `pwd`/crypto-config/ordererOrganizations/honda.com/orderers/node1.honda.com/tls/ca.crt"
export CORE_PEER_TLS_ROOTCERT_FILE=`pwd`/crypto-config/peerOrganizations/carfax.com/peers/node2.carfax.com/tls/ca.crt
export CORE_PEER_TLS_ENABLED=true
export CORE_PEER_MSPCONFIGPATH=`pwd`/crypto-config/peerOrganizations/carfax.com/users/Admin@carfax.com/msp 
export CORE_PEER_LOCALMSPID=PeerOrg 
/opt/gopath/src/github.com/hyperledger/fabric/build/bin/peer channel create $ORDERER_TLS -f yacov.tx  -c yacov -o node1:7050

configtx.yaml 的内容

---
Profiles:

    Genesis:
        Orderer:
            <<: *OrdererDefaults
            Organizations:
                - *OrdererOrg
        Consortiums:
             SampleConsortium:
                Organizations:
                - *PeerOrg
    Channels:
        Consortium: SampleConsortium
        Application:
            <<: *ApplicationDefaults
            Organizations:
                - *PeerOrg

Organizations:

    - &OrdererOrg
        Name: OrdererOrg

        ID: OrdererOrg

        MSPDir: crypto-config/ordererOrganizations/honda.com/msp

        AdminPrincipal: Role.ADMIN


    - &PeerOrg
        Name: PeerOrg

        ID: PeerOrg

        MSPDir: crypto-config/peerOrganizations/carfax.com/msp

        AdminPrincipal: Role.ADMIN


        AnchorPeers:
            - Host: 
              Port: 7051


Orderer: &OrdererDefaults

    OrdererType: solo

    Addresses:
        - node1:7050

    BatchTimeout: 1ms

    BatchSize:

        MaxMessageCount: 10

        AbsoluteMaxBytes: 99 MB

        PreferredMaxBytes: 512 KB

    MaxChannels: 0

    Kafka:
        Brokers:
            - 127.0.0.1:9092

    Organizations:

Application: &ApplicationDefaults

    Organizations:

执行创世区块时的命令行语句输出

2017-08-18 16:50:37.015 IST [common/tools/configtxgen] main -> INFO 001 Loading configuration

2017-08-18 16:50:37.175 IST [common/tools/configtxgen] doOutputBlock -> INFO 002 生成创世块 2017-08-18 16:50:37.179 IST [common/tools/configtxgen] doOutputBlock -> INFO 003 写入创世块

创世块输出

 <1.{��������G<&�����n��ix*s!�0
�0
�0
t
����"system*@d6a8b389f09cd34562dda9af564c11bd28fed0ae9c42070f11a56c678b19e704h�N�b����S���>%��_bٮ�/
�/�/�

Consortiums��
SampleConsortium��
PeerOrg��
MSP���
PeerOrg�-----BEGIN CERTIFICATE-----
MIICKzCCAdGgAwIBAgIQCxUbHYlT+2GRvjnArG6gZjAKBggqhkjOPQQDAjBnMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZy
YW5jaXNjbzETMBEGA1UEChMKY2FyZmF4LmNvbTEWMBQGA1UEAxMNY2EuY2FyZmF4
LmNvbTAeFw0xNzA4MTgxMTIwMzZaFw0yNzA4MTYxMTIwMzZaMGcxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
MRMwEQYDVQQKEwpjYXJmYXguY29tMRYwFAYDVQQDEw1jYS5jYXJmYXguY29tMFkw
EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUufxUYHLgvaxfm6AObKj60v4dIwd0/gT
Xd17VLEWlUpNR63se9yjzIbKzBw2rxje+9GalDDOaNJzFG+XXNz6wKNfMF0wDgYD
VR0PAQH/BAQDAgGmMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zAp
BgNVHQ4EIgQgEk7d6Qvvq5FBNjXfHh0Fa4MjzHXcsIKg0+B+vdZT6D8wCgYIKoZI
zj0EAwIDSAAwRQIhAI7atq+JHSmzBwZ034y6u54+uBPe+S9qyqrTVDQ9a6RoAiBG
n8WRFVKobSeMJR6igf78tAjWVuSdEhhBJV2rGKmD1Q==
-----END CERTIFICATE-----
"�-----BEGIN CERTIFICATE-----
MIICBzCCAa2gAwIBAgIQfWg0mgPDxGOBJpfWRqJ3tzAKBggqhkjOPQQDAjBnMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZy
YW5jaXNjbzETMBEGA1UEChMKY2FyZmF4LmNvbTEWMBQGA1UEAxMNY2EuY2FyZmF4
LmNvbTAeFw0xNzA4MTgxMTIwMzZaFw0yNzA4MTYxMTIwMzZaMFUxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNpc2Nv
MRkwFwYDVQQDDBBBZG1pbkBjYXJmYXguY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0D
AQcDQgAEWmAAX6Xj0/H7a5S6K5lA7u1pQLYZ/6iTTLn2E1JTWTd0jI5sh0zcL9qf
dkfIk/8G0u6rLUA8WDv0EZqvi8Mt8KNNMEswDgYDVR0PAQH/BAQDAgeAMAwGA1Ud
EwEB/wQCMAAwKwYDVR0jBCQwIoAgEk7d6Qvvq5FBNjXfHh0Fa4MjzHXcsIKg0+B+
vdZT6D8wCgYIKoZIzj0EAwIDSAAwRQIhAI3IKnk6Rxw3s78GuTpwiVjObwR1ylOo
juILM99AMMFrAiAUx31MEvAZaw89QQ8KirZzl/JnCERoQ0kz8ov3jiFJzA==
-----END CERTIFICATE-----
B
SHA2SHA256J�-----BEGIN CERTIFICATE-----
MIICMDCCAdegAwIBAgIQbuC39Z6/ccEP3hMMe5cGSjAKBggqhkjOPQQDAjBqMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZy
YW5jaXNjbzETMBEGA1UEChMKY2FyZmF4LmNvbTEZMBcGA1UEAxMQdGxzY2EuY2Fy
ZmF4LmNvbTAeFw0xNzA4MTgxMTIwMzZaFw0yNzA4MTYxMTIwMzZaMGoxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1TYW4gRnJhbmNp
c2NvMRMwEQYDVQQKEwpjYXJmYXguY29tMRkwFwYDVQQDExB0bHNjYS5jYXJmYXgu
Y29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2oEQ9GicVdKYvI9pHj3iWb4P
rjT7VO8weBDbDe0/MfxwhDsXe5uReASpL2YcbUYb1nCc/n9z/qvq23LXzPusaKNf
MF0wDgYDVR0PAQH/BAQDAgGmMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUw
AwEB/zApBgNVHQ4EIgQg/o+D3yG/Yzjm3Ka2AcI8VU63RSvF8aHIvnD10/EQtZgw
CgYIKoZIzj0EAwIDRwAwRAIgXM/MWiZFfRQdAy1ybRHV8/A2IO8Xu6+aIKcSK5kF
mXgCIBFDIzDA0DjeO0O3F7dBEf3nbiSvCQgIBQQbjGKm15+D
-----END CERTIFICATE-----
Admins"1
Admins'

PeerOrgAdmins"0
Readers%

PeerOrgAdmins"0
Writers%

PeerOrgAdmins*Admins@
ChannelCreationPolicy'

Admins/Channel/Orderer/Admins*/Channel/Orderer/Admins"
AdminsAdmins*/Channel/Orderer/Admins�
Orderer��

OrdererOrg��
MSP���

OrdererOrg�-----BEGIN CERTIFICATE-----
MIICJzCCAc6gAwIBAgIRAIMBXTi8vzqOVhQiXB+ovQMwCgYIKoZIzj0EAwIwZTEL
MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBG
cmFuY2lzY28xEjAQBgNVBAoTCWhvbmRhLmNvbTEVMBMGA1UEAxMMY2EuaG9uZGEu
Y29tMB4XDTE3MDgxODExMjAzNloXDTI3MDgxNjExMjAzNlowZTELMAkGA1UEBhMC
VVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lzY28x
EjAQBgNVBAoTCWhvbmRhLmNvbTEVMBMGA1UEAxMMY2EuaG9uZGEuY29tMFkwEwYH
KoZIzj0CAQYIKoZIzj0DAQcDQgAEm3VY12jlinzimYav4K39anZGIyd7DrygL7fV
b57S7tpvwTXWfGNt58tDBf584w1Bw7Yr6M3unJjWfNj7VaLwd6NfMF0wDgYDVR0P
AQH/BAQDAgGmMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB/zApBgNV
HQ4EIgQgMfMrGCUNqJqCehc2xsAYVyWqVTV3jYDcnmkyBhtFSGcwCgYIKoZIzj0E
AwIDRwAwRAIgMrdpDfMnULyS2dMtjfdWGAXPxDj4URM0nelcSjOpmAoCIB24mFvn
C34fP8icL0QVIOf+mPin2jD4HgsDP58dDFtu
-----END CERTIFICATE-----
"�-----BEGIN CERTIFICATE-----
MIICBDCCAaqgAwIBAgIQOHnvuaxK4NLP1+Qb7OIm+DAKBggqhkjOPQQDAjBlMQsw
CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZy
YW5jaXNjbzESMBAGA1UEChMJaG9uZGEuY29tMRUwEwYDVQQDEwxjYS5ob25kYS5j
b20wHhcNMTcwODE4MTEyMDM2WhcNMjcwODE2MTEyMDM2WjBUMQswCQYDVQQGEwJV
UzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNjbzEY
MBYGA1UEAwwPQWRtaW5AaG9uZGEuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEUe6whrR0aqrwMJ+kKZaAetMAYmBON4S9yu0VPaGDuaEmQufj6guOFP6eQ+6A
LPRa1LaDEWAO0sPg9xtSc2P0MaNNMEswDgYDVR0PAQH/BAQDAgeAMAwGA1UdEwEB
/wQCMAAwKwYDVR0jBCQwIoAgMfMrGCUNqJqCehc2xsAYVyWqVTV3jYDcnmkyBhtF
SGcwCgYIKoZIzj0EAwIDSAAwRQIhAMS9lF1z1wyp90zW2rgrIz7m0iX/hCUyR15N
kSPTuzTQAiB6HWU0nabnzQHOcWwalz4WoCeIJRA6kjpQoP7yq7JmrQ==
-----END CERTIFICATE-----
B
SHA2SHA256J�-----BEGIN CERTIFICATE-----
MIICLjCCAdSgAwIBAgIRAP+2jzBK3BFU8vDd0QvneV4wCgYIKoZIzj0EAwIwaDEL
MAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBG
cmFuY2lzY28xEjAQBgNVBAoTCWhvbmRhLmNvbTEYMBYGA1UEAxMPdGxzY2EuaG9u
ZGEuY29tMB4XDTE3MDgxODExMjAzNloXDTI3MDgxNjExMjAzNlowaDELMAkGA1UE
BhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNhbiBGcmFuY2lz
Y28xEjAQBgNVBAoTCWhvbmRhLmNvbTEYMBYGA1UEAxMPdGxzY2EuaG9uZGEuY29t
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE3vaA4FhLDOMH7h39Ih2ivixOlg+n
OI7+mF0GQrG8f2qop4gSaZQwtVIj5MpzTBcKqaa0l0k8FDdlobDtJ94QVKNfMF0w
DgYDVR0PAQH/BAQDAgGmMA8GA1UdJQQIMAYGBFUdJQAwDwYDVR0TAQH/BAUwAwEB
/zApBgNVHQ4EIgQgxL6aI6nufoznFDDukcIWHhrAYIrNu7tNFYfHsoxgX0IwCgYI
KoZIzj0EAwIDSAAwRQIhAJ5fLjps0Fq0r0l0Vfi1/35TMYgo9/6rNRkjnCZ3xPEV
AiAVbQba7Pg9s8Ej6ok2zta1biohj5+k/flDM5KXM1NfOg==
-----END CERTIFICATE-----
Admins"4
Admins*

OrdererOrgAdmins"3
Readers(


OrdererOrgAdmins"3
Writers(


OrdererOrgAdmins*Admins!
ConsensusType
soloAdmins"
    BatchSize

���1�� Admins

BatchTimeout
1msAdmins
ChannelRestrictionsAdmins"*
ockValidation
WritersAdmins""
aders
ReadersAdmins""
iters
WritersAdmins""
Admins

AdminsAdmins*Admins&
HashingAlgorithm
SHA256Admins-
BlockDataHashingStructure����Admins;
OrdererAddresses'


node1:7050/Channel/Orderer/Admins""
aders
ReadersAdmins""
iters
WritersAdmins""
Admins

AdminsAdmins*Admins

【问题讨论】:

  • here 的评论表明它可能与签名者有关
  • 阿尤夏,谢谢。我检查了帖子,但我无法弄清楚它哪里出错了
  • @Deepa 我知道你已经解决了这个问题。正如您在开始时所说,“我没有使用 docker 方法,而是运行实际的可执行文件本身。”,当您运行可执行文件时:它会生成所有加密材料和通道。所以,你在重复执行。因此,您遇到了上述错误。
  • @sun 能解决这个错误吗?您能否分享一下您如何解决此问题的方法。

标签: hyperledger hyperledger-fabric


【解决方案1】:

错误:出现意外状态:BAD_REQUEST -- 授权更新错误:验证 DeltaSet 时出错:[Groups] /Channel/Application 的策略不满足:未能达到 1 个子策略的隐式阈值,需要剩余 1 个

通常表示通道创建交易的签名者没有联盟组织之一的管理员权限,但是,它可能表示由于许多其他原因而失败。

不幸的是,该错误必须有点神秘,以避免泄露有关联盟或频道成员的信息。要了解根本原因,您需要检查订购者日志。如果尚未设置,您将希望在开始之前将orderer.yaml 中的日志级别提高到debug,或者通过设置FABRIC_LOGGING_SPEC=debug(或v1.4.x 之前的Fabric 版本ORDERER_GENERAL_LOGLEVEL=debug)订货人。在您的 orderer 日志中,您将看到与对等客户端输出相同的错误文本,但在前面的行中,您会看到导致错误的其他原因。

最常见的原因是:

  1. 该身份不在组织的管理员列表中。
  2. 身份的证书未由 org CA 链有效签名。
  3. 订购者不知道该身份的组织。

其他一些不太可能的可能性,因为您使用的是对等二进制文件而不是自定义代码:

  1. 签名与身份或签名字节不匹配。
  2. 身份格式错误。

假设原因从订购者日志中不明显,如果您在此处发布它们,我很乐意帮助诊断它们。

哦,作为一个有用的提示。使用configtxgen -inspectBlock &lt;genesis.block&gt;,您可能会看到更易于阅读的创世块版本。

编辑:回顾您帖子的顶部,我在订购者日志中看到此输出:

ERRO 02d 主体反序列化失败(提供的标识为 无效,Verify() 返回 x509:证书由未知签名 权威)身份

这表明证书声称由 CA 颁发,但未由订购者知道的 CA 签名(上述错误类型 2)。如果您引导 orderer,然后为您的环境重新生成加密材料而不删除 orderer 的存储目录,这通常会发生。

请务必记住,ORDERER_GENERAL_BOOTSTRAPFILE(或 v2.0.0 之前的 ORDERER_GENERAL_GENESISFILE)仅在系统尚未启动时才被读取,因此更改排序者的创世块不会有任何影响,除非排序者存储也被删除了。

【讨论】:

  • 感谢 Jason 的宝贵意见。我添加了带有调试信息的排序日志信息。让我知道您是否可以诊断问题
  • 正如我在上面编辑的帖子中指出的那样,根本问题似乎在这里:> 2017-08-20 17:54:19.392 IST [cauthdsl] func2 -> ERRO 181 Principal 反序列化失败(提供的身份无效,Verify() 返回 x509: 由未知机构签名的证书) 这意味着创世块内的加密材料与用于签署交易的加密材料不匹配。这通常发生在重新生成加密货币但未删除订购者分类帐时。
  • 谢谢杰森。生成了两种加密材料(在我的情况下),程序指的是相对路径。一旦我使用绝对路径并将其指向正确的加密货币,一切都像魅力一样!
  • 您好,我遇到了类似的问题。但我认为这与身份不在组织列表中有关。因为在日志中我得到的是 DEBU 14d 检查身份是否满足 Org1MSP 的管理员角色 2017-11-13 05:44:13.330 UTC [cauthdsl] func2 -> DEBU 14e 0xc4201112b8 身份 0 不满足主体:此身份不是管理员如何制作身份管理员
  • 如果您在尝试删除网络并重新开始后遇到此错误,除了docker stopdocker rm,您还需要运行docker volume prune删除旧卷和相关数据(旧证书等)在启动新网络之前。您的卷应命名为 byfn_orderer.example.com 之类的名称,因此如果稍后以相同名称启动容器,则可以重用该卷 - 然后您的新证书将不会在容器中使用。还要确保您的 docker 映像未使用新数据提交(可能需要下载新映像)
【解决方案2】:

以下解决方案对我有用。

进入您的对等 docker 容器。转到/etc/hyperledger/msp/users/Admin@org1.example.com/msp 并运行export CORE_PEER_MSPCONFIGPATH=$PWD

使用适当的标志再次运行您的 peer channel create 命令。

【讨论】:

    【解决方案3】:

    就我而言,唯一缺少的是正确定义CORE_PEER_MSPCONFIGPATH。 使用面料 1.1 希望对其他人有所帮助。

    【讨论】:

      【解决方案4】:

      在我的例子中,它是 docker-compose 文件中缺少的一些条目:

      ORDERER_GENERAL_TLS_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt] 改成ORDERER_GENERAL_TLS_ROOTCAS=[/var/hyperledger/orderer/tls/ca.crt, /etc/hyperledger/crypto/peerORG1/tls/ca.crt, /etc/hyperledger/crypto/peerORG2/tls/ca.crt, /etc/hyperledger/crypto/peerORG3/tls/ca.crt] 然后就可以了。

      所以您可能需要检查一下,尤其是在您有自定义设置的情况下。

      【讨论】:

        【解决方案5】:

        这与 TLS 无关,因为请求已到达 orderer。 是否是 TLS 问题 - 您不会收到以下错误:

        错误:出现意外状态:BAD_REQUEST -- 授权更新时出错: 验证 DeltaSet 时出错:[Groups] /Channel/Application 的策略 不满足:未能达到 1 个子策略的隐式阈值, 还需要 1 个

        现在,该错误基本上意味着您尝试发送交易以创建频道,但该交易是由不是频道管理员的用户(客户端证书)签署的。

        您需要在命令前加上类似于this: 的前缀:

        CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp
        

        【讨论】:

        • 谢谢 Yacovm,我仍然面临同样的问题。我提供了有关我的设置的其他信息。请让我知道我错过了什么
        • 请添加脚本生成的configtx.yaml,以及configtxgen --outputBlock genesis.block的输出
        • 添加了请求的内容。如果您需要更多详细信息,请告诉我
        猜你喜欢
        • 2019-05-21
        • 1970-01-01
        • 2019-01-06
        • 2019-07-26
        • 2019-02-04
        • 2019-06-01
        • 1970-01-01
        • 1970-01-01
        • 2018-06-19
        相关资源
        最近更新 更多