光纤网订购者TLS：无法在证书输入中找到任何PEM数据

时间：2018-07-31 08:34:21

标签： ssl hyperledger-fabric tls1.2

您好，我正在设置基于Kafka的TLS启用1.2结构订购服务。启动时出现以下错误：

orderer.test.com    | 2018-07-31 07:59:40.819 UTC [orderer/consensus/kafka] newBrokerConfig -> CRIT 034 Unable to decode public/private key pair: tls: failed to find any PEM data in certificate input
orderer.test.com    | panic: Unable to decode public/private key pair:tls: failed to find any PEM data in certificate input
orderer.test.com    | 
orderer.test.com    | goroutine 1 [running]:
orderer.test.com    | github.com/hyperledger/fabric/vendor/github.com/op/go-logging.(*Logger).Panic(0xc420176de0, 0xc4205e64a0, 0x2, 0x2)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/vendor/github.com/op/go-logging/logger.go:188 +0xbd
orderer.test.com    | github.com/hyperledger/fabric/orderer/consensus/kafka.newBrokerConfig(0x1, 0xc4200340dd, 0x8, 0xc42003407e, 0x9, 0xc4205ae7b0, 0x1, 0x1, 0x0, 0x0, ...)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/consensus/kafka/config.go:40 +0x287
orderer.test.com    | github.com/hyperledger/fabric/orderer/consensus/kafka.New(0x12a05f200, 0x8bb2c97000, 0x45d964b800, 0x274a48a78000, 0x2540be400, 0x2540be400, 0x2540be400, 0x3, 0xee6b280, 0x3, ...)
orderer.test.com    | 2018-07-31 07:59:40.819 UTC [orderer/consensus/kafka] newBrokerConfig -> CRIT 034 Unable to decode public/private key pair: tls: failed to find any PEM data in certificate input
orderer.test.com    | panic: Unable to decode public/private key pair:tls: failed to find any PEM data in certificate input
orderer.test.com    | 
orderer.test.com    | goroutine 1 [running]:
orderer.test.com    | github.com/hyperledger/fabric/vendor/github.com/op/go-logging.(*Logger).Panic(0xc420176de0, 0xc4205e64a0, 0x2, 0x2)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/vendor/github.com/op/go-logging/logger.go:188 +0xbd
orderer.test.com    | github.com/hyperledger/fabric/orderer/consensus/kafka.newBrokerConfig(0x1, 0xc4200340dd, 0x8, 0xc42003407e, 0x9, 0xc4205ae7b0, 0x1, 0x1, 0x0, 0x0, ...)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/consensus/kafka/config.go:40 +0x287
orderer.test.com    | github.com/hyperledger/fabric/orderer/consensus/kafka.New(0x12a05f200, 0x8bb2c97000, 0x45d964b800, 0x274a48a78000, 0x2540be400, 0x2540be400, 0x2540be400, 0x3, 0xee6b280, 0x3, ...)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/consensus/kafka/consenter.go:22 +0xb3
orderer.test.com    | github.com/hyperledger/fabric/orderer/common/server.initializeMultichannelRegistrar(0xc4200dc280, 0xe07660, 0x14a0c78, 0xc4201700a0, 0x1, 0x1, 0xc4204f3ed0)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:258 +0x164
orderer.test.com    | github.com/hyperledger/fabric/orderer/common/server.Start(0xd6a0d7, 0x5, 0xc4200dc280)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:101 +0x1d3
orderer.test.com    | github.com/hyperledger/fabric/orderer/common/server.Main()
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:80 +0x204
orderer.test.com    | main.main()
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/main.go:15 +0x20
orderer.test.com exited with code 2orderer.test.com    |    /opt/gopath/src/github.com/hyperledger/fabric/orderer/consensus/kafka/consenter.go:22 +0xb3
orderer.test.com    | github.com/hyperledger/fabric/orderer/common/server.initializeMultichannelRegistrar(0xc4200dc280, 0xe07660, 0x14a0c78, 0xc4201700a0, 0x1, 0x1, 0xc4204f3ed0)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:258 +0x164
orderer.test.com    | github.com/hyperledger/fabric/orderer/common/server.Start(0xd6a0d7, 0x5, 0xc4200dc280)
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:101 +0x1d3
orderer.test.com    | github.com/hyperledger/fabric/orderer/common/server.Main()
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:80 +0x204
orderer.test.com    | main.main()
orderer.test.com    |   /opt/gopath/src/github.com/hyperledger/fabric/orderer/main.go:15 +0x20
orderer.test.com exited with code 2

之前在这里曾报道过完全相同的问题：

https://lists.hyperledger.org/g/fabric/message/2803

不幸的是，可能产生解决方案的引用链接不再起作用。谁能指出我正确的方向？

下面列出的加密材料和配置。

环境变量：

ORDERER_HOST=orderer.test.com
ORDERER_GENERAL_LOGLEVEL=debug
ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
ORDERER_GENERAL_GENESISMETHOD=file
ORDERER_GENERAL_GENESISFILE=/etc/genesis.block
ORDERER_GENERAL_LOCALMSPID=testMSP
ORDERER_GENERAL_LOCALMSPDIR=/etc/MSP
ORDERER_GENERAL_TLS_ENABLED=true
ORDERER_GENERAL_TLS_PRIVATEKEY=/etc/tlsMSP/keystore/key.pem
ORDERER_GENERAL_TLS_CERTIFICATE=/etc/tlsMSP/signcerts/cert.pem
ORDERER_GENERAL_TLS_ROOTCAS=[/etc/MSP/tlscacerts/tlsca.pem]
ORDERER_GENERAL_TLS_CLIENTAUTHREQUIRED=false
CORE_LOGGING_GRPC=DEBUG
GRPC_VERBOSITY=debug
GRPC_TRACE=al
ORDERER_KAFKA_SERVER=kafka0.test.com
ORDERER_KAFKA_VERBOSE=true
ORDERER_KAFKA_TLS_ENABLED=true
ORDERER_KAFKA_TLS_PRIVATEKEY=/key.key
ORDERER_KAFKA_TLS_CERTIFICATE=/cert.crt
ORDERER_KAFKA_TLS_ROOTCAS=[/tlsca.pem]

key.key：

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgJ1rISGBPRg61KDbF
udVvElYmc7giHLWgh5XUplifoaChRANCAATYKrLJMdrkMVNm8+CttPKvQFD4JXx3
FDfsyrDnx2Bbi1UdnKb9jFHbbTce8XTKT+X/g2Zg7d2kYH1SEMILcK2E
-----END PRIVATE KEY-----

cert.crt：

-----BEGIN CERTIFICATE-----
MIICoTCCAkigAwIBAgIUObixzriJ3uXJPxUlkAtQpgsJPmAwCgYIKoZIzj0EAwIw
GTEXMBUGA1UEAwwOdGxzY2EudGVzdC5jb20wHhcNMTgwNzMxMDgwNjAwWhcNMTgw
ODAxMDgxMDIxWjCBiTELMAkGA1UEBhMCVVMxFzAVBgNVBAgTDk5vcnRoIENhcm9s
aW5hMRQwEgYDVQQKEwtIeXBlcmxlZGdlcjEwMA0GA1UECxMGY2xpZW50MAsGA1UE
CxMEb3JnMTASBgNVBAsTC2RlcGFydG1lbnQxMRkwFwYDVQQDExBvcmRlcmVyLnRl
c3QuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2CqyyTHa5DFTZvPgrbTy
r0BQ+CV8dxQ37Mqw58dgW4tVHZym/YxR2203HvF0yk/l/4NmYO3dpGB9UhDCC3Ct
hKOB/DCB+TAOBgNVHQ8BAf8EBAMCB4AwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQU
owm7JB6KFWDrDILaXIcnEK5pNuowHwYDVR0jBBgwFoAUhkYpJ0V1VWWN6pPM6mNn
iT+3gQYwJAYDVR0RBB0wG4IQb3JkZXJlci50ZXN0LmNvbYIHaGFwcm94eTBzBggq
AwQFBgcIAQRneyJhdHRycyI6eyJoZi5BZmZpbGlhdGlvbiI6Im9yZzEuZGVwYXJ0
bWVudDEiLCJoZi5FbnJvbGxtZW50SUQiOiJvcmRlcmVyLnRlc3QuY29tIiwiaGYu
VHlwZSI6ImNsaWVudCJ9fTAKBggqhkjOPQQDAgNHADBEAiB+keAyxKPforxJNhfR
aGO9JdZhM00CurJtXR8OkkqkMgIgX2X6vXI7JoY1VOBwLdyDm77l0ANgCg/RjzU1
oc50/UU=
-----END CERTIFICATE-----

tlsca.pem：

-----BEGIN CERTIFICATE-----
MIIBhDCCASqgAwIBAgIJAOs5Ev8Tj+JmMAoGCCqGSM49BAMCMBkxFzAVBgNVBAMM
DnRsc2NhLnRlc3QuY29tMB4XDTE4MDczMTA4MTAyMVoXDTE4MDgwMTA4MTAyMVow
GTEXMBUGA1UEAwwOdGxzY2EudGVzdC5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMB
BwNCAAR1Ie9D1zjU/S873/xDevseR9Nsh6nUPtvZMm4iajLRyxcWC+hfiHQHtXdP
pOea1dJqLCEeT5cjkXM3Dr+0rclIo1swWTAMBgNVHRMEBTADAQH/MAsGA1UdDwQE
AwIBpjAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFIZG
KSdFdVVljeqTzOpjZ4k/t4EGMAoGCCqGSM49BAMCA0gAMEUCIQCOY9PYchyuxUN5
LhaxQifphJyQJqIAat9ZRZCr9T5cxwIgT/B3uoBEFLgU8W6OJyLBHHFgjZls7aD+
GUzOTB/dMVI=
-----END CERTIFICATE-----

1 个答案:

答案 0 :(得分：1)

之所以会出现此问题，是因为您用文件路径而不是文件内容（即PEM数据）填充了环境变量。不幸的是，当订购者期望内容和期望路径时，其配置不一致。

如orderer.yaml的示例配置中所述，您可以将_FILE附加到Kafka TLS的环境变量中，并使用文件路径而不是PEM内容，如下所示：

ORDERER_KAFKA_TLS_PRIVATEKEY_FILE=/key.key
ORDERER_KAFKA_TLS_CERTIFICATE_FILE=/cert.crt
ORDERER_KAFKA_TLS_ROOTCAS_FILE=[/tlsca.pem]

这应该可以解决您的问题，并允许订购者找到合适的PEM数据。

相关问题
最新问题