Question

我正在尝试将新组织添加到对等组织Org1MSP。我修改了config.yaml目录中的msp文件。修改文件后，内容如下：

 OrganizationalUnitIdentifiers:
  - Certificate: cacerts/ca.org1.example.com-cert.pem
    OrganizationalUnitIdentifier: TEST

修改后，我生成了genesis.block和channel.tx。我正在使用docker引导我的网络。问题是当我引导网络时，订购者将引发错误并退出。订购者的日志如下所示：

orderer.example.com       | 2018-10-24 22:00:45.704 UTC [msp] satisfiesPrincipalInternalPreV13 -> DEBU 05b Checking if identity satisfies role [CLIENT] for Org1MSP
orderer.example.com       | 2018-10-24 22:00:45.704 UTC [msp] Validate -> DEBU 05c MSP Org1MSP validating identity
orderer.example.com       | 2018-10-24 22:00:45.704 UTC [msp] getCertificationChain -> DEBU 05d MSP Org1MSP getting certification chain
orderer.example.com       | 2018-10-24 22:00:45.704 UTC [msp] getCertificationChain -> DEBU 05e MSP Org1MSP getting certification chain
orderer.example.com       | 2018-10-24 22:00:45.704 UTC [msp] getCertificationChain -> DEBU 05f MSP Org1MSP getting certification chain
orderer.example.com       | 2018-10-24 22:00:45.705 UTC [orderer/commmon/multichannel] newLedgerResources -> PANI 060 Error creating channelconfig bundle: initializing channelconfig failed: could not create channel Consortiums sub-group config: setting up the MSP manager failed: admin 0 is invalid: The identity is not valid under this MSP [Org1MSP]: could not validate identity's OUs: none of the identity's organizational units [[0xc4204e9ad0]] are in MSP Org1MSP
orderer.example.com       | panic: Error creating channelconfig bundle: initializing channelconfig failed: could not create channel Consortiums sub-group config: setting up the MSP manager failed: admin 0 is invalid: The identity is not valid under this MSP [Org1MSP]: could not validate identity's OUs: none of the identity's organizational units [[0xc4204e9ad0]] are in MSP Org1MSP
orderer.example.com       | 
orderer.example.com       | goroutine 1 [running]:
orderer.example.com       | github.com/hyperledger/fabric/vendor/go.uber.org/zap/zapcore.(*CheckedEntry).Write(0xc4200f0630, 0x0, 0x0, 0x0)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/vendor/go.uber.org/zap/zapcore/entry.go:229 +0x4f4
orderer.example.com       | github.com/hyperledger/fabric/vendor/go.uber.org/zap.(*SugaredLogger).log(0xc42017a1e0, 0x4, 0xe14c6d, 0x27, 0xc4204af958, 0x1, 0x1, 0x0, 0x0, 0x0)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/vendor/go.uber.org/zap/sugar.go:234 +0xf6
orderer.example.com       | github.com/hyperledger/fabric/vendor/go.uber.org/zap.(*SugaredLogger).Panicf(0xc42017a1e0, 0xe14c6d, 0x27, 0xc4204af958, 0x1, 0x1)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/vendor/go.uber.org/zap/sugar.go:159 +0x79
orderer.example.com       | github.com/hyperledger/fabric/common/flogging.(*FabricLogger).Panicf(0xc42017a1e8, 0xe14c6d, 0x27, 0xc4204af958, 0x1, 0x1)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/common/flogging/zap.go:74 +0x60
orderer.example.com       | github.com/hyperledger/fabric/orderer/common/multichannel.(*Registrar).newLedgerResources(0xc4202725a0, 0xc420178e60, 0xc420178e60)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/multichannel/registrar.go:256 +0x2ea
orderer.example.com       | github.com/hyperledger/fabric/orderer/common/multichannel.NewRegistrar(0xea36a0, 0xc42000c3a0, 0xc4202567b0, 0xe9b060, 0x15a78b0, 0xc42017a2f0, 0x1, 0x1, 0x0)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/multichannel/registrar.go:142 +0x312
orderer.example.com       | github.com/hyperledger/fabric/orderer/common/server.initializeMultichannelRegistrar(0xc420100580, 0xe9b060, 0x15a78b0, 0xc42017a2f0, 0x1, 0x1, 0x0)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:258 +0x250
orderer.example.com       | github.com/hyperledger/fabric/orderer/common/server.Start(0xdf7a5a, 0x5, 0xc420100580)
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:96 +0x226
orderer.example.com       | github.com/hyperledger/fabric/orderer/common/server.Main()
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/orderer/common/server/main.go:75 +0x1d6
orderer.example.com       | main.main()
orderer.example.com       |     /opt/gopath/src/github.com/hyperledger/fabric/orderer/main.go:15 +0x20
orderer.example.com exited with code 2

我正在使用Hyperledger Fabric v1.3

完整的日志可以在这里找到：https://hastebin.com/ujiluvupox.php

如果您有任何建议，请告诉我。任何帮助/评论将不胜感激。

Answer 1

要对MSP中的config.yaml文件进行编辑，要求cacerts/ca.org1.example.com-cert.pem颁发的所有证书都具有OU TEST。

如果您使用以下方法检查MSP目录中的管理员证书：


openssl x509 -noout -text -in msp/admincerts/Admin\@org1.example.com-cert.pem | grep OU

您应该能够看到证书的OU。最有可能的是，您的管理证书没有设置此OU，因此它不被视为由您的MSP有效颁发的（因此，在引导程序上设置MSP时出错）。

如果您使用cryptogen引导网络，则应编辑crypto-config.yaml文件。在您的组织下，添加一个CA元素和一个OrganizationalUnit: <YOUR_OU>子元素。例如：


OrdererOrgs:
  # ---------------------------------------------------------------------------
  # Orderer
  # ---------------------------------------------------------------------------
  - Name: Orderer
    Domain: example.com
    CA:
        OrganizationalUnit: TEST
    # ---------------------------------------------------------------------------
    # "Specs" - See PeerOrgs below for complete description
    # ---------------------------------------------------------------------------
    Specs:
      - Hostname: orderer

我还要指出，如果您使用cryptogen引导环境，那么很有可能不需要在MSP的config.yaml文件中要求OU。尝试与现有组织的CA服务器集成时，从您的CA要求特定的OU是最有用的，它可能会出于其他目的颁发证书，但并非所有证书都可以与Fabric一起使用。

Answer 2

因此，我认为问题出在加密材料中。如果在MSP配置中启用NodeOU，则在使用cryptogen生成加密材料时也必须启用它。请查看https://github.com/hyperledger/fabric/blob/a980c8f659051280c4e71f92fc6808ccff49e5d1/common/tools/cryptogen/main.go#L108和https://github.com/hyperledger/fabric/blob/a980c8f659051280c4e71f92fc6808ccff49e5d1/common/tools/cryptogen/main.go#L192。希望这可以帮助。

在对等组织中实施组织单位标识符会导致订购者恐慌并退出

2 个答案: