如何使用sslmode = verify-ca或verify-full将postgres添加为hyperledger fabric-ca中的数据库？

Question

我正在尝试在fabric-ca中将postgres添加为数据库，并以ssl=require模式成功完成此操作，但是无法使用ssl=verify-ca或verify-full

我的docker-compose.yaml文件是这样的：

version: '2'

networks:
  basic:

services:
  orderer.lynkit.io:
    container_name: orderer.lynkit.io
    image: hyperledger/fabric-orderer:1.4.1
    environment:
      - ORDERER_GENERAL_LOGLEVEL=DEBUG
      - ORDERER_GENERAL_LISTENADDRESS=0.0.0.0
      - ORDERER_GENERAL_GENESISMETHOD=file
      - ORDERER_GENERAL_GENESISFILE=/etc/hyperledger/configtx/genesis.block
      - ORDERER_GENERAL_LOCALMSPID=OrdererMSP
      - ORDERER_GENERAL_LOCALMSPDIR=/etc/hyperledger/msp/orderer/msp
    working_dir: /opt/gopath/src/github.com/hyperledger/fabric/orderer
    command: orderer
    ports:
      - 7050:7050
    volumes:
        - ./config/:/etc/hyperledger/configtx
        - ./crypto-config/ordererOrganizations/lynkit.io/orderers/orderer.lynkit.io/:/etc/hyperledger/msp/orderer
    networks:
      - basic

  pgadmin4:
      image: dpage/pgadmin4
      environment:
        PGADMIN_DEFAULT_EMAIL: admin@root.com
        PGADMIN_DEFAULT_PASSWORD: SuperSecret
      volumes:
        - ./pgadmin-data:/var/lib/postgresql/data
      ports:
        - 80:80
      networks:
         - basic

  ica.consigner.lynkit.io:
    image: hyperledger/fabric-ca:1.4.1
    environment:
      - FABRIC_CA_HOME=/etc/hyperledger/fabric-ca-server
      - FABRIC_CA_SERVER_OPERATIONS_LISTENADDRESS=127.0.0.1:8443
      - FABRIC_CA_SERVER_DB_TYPE=postgres
      - FABRIC_CA_SERVER_CSR_CN= ica.consigner.lynkit.io
      - FABRIC_CA_SERVER_CSR_HOSTS=0.0.0.0
      - FABRIC_CA_SERVER_DB_DATASOURCE=host=db-postgres port=5432 user=postgres password=caDbPass12345 dbname=fabriccaserver sslmode=verify-ca 
      - FABRIC_CA_SERVER_DB_TLS_ENABLED=true
      - FABRIC_CA_SERVER_DB_TLS_CERTFILES=[/tmp/postgresCerts/root.crt]
      - FABRIC_CA_SERVER_DB_TLS_CLIENT_CERTFILE=/tmp/postgresCerts/server.crt
      - FABRIC_CA_SERVER_DB_TLS_CLIENT_KEYFILE=/tmp/postgresCerts/server.key  

    ports:
      - "7054:7054"
    command: sh -c 'fabric-ca-server start -b admin:adminpw -d' 
    volumes:
      - ./crypto-config/peerOrganizations/consigner.lynkit.io/ca/:/etc/hyperledger/fabric-ca-server-config
      - ./ca-config/:/etc/hyperledger/fabric-ca-server
      # - ./ca-config/ssl/postgres:/etc/hyperledger/fabric-ca-server/ssl
      - /home/adarsha/postgresCerts:/tmp/postgresCerts

    container_name: ica.consigner.lynkit.io
    networks:
      - basic 
    depends_on:
         - db-postgres

  db-postgres:
      container_name: db-postgres
      # network_mode: "host"
      image: postgres:latest
      environment:
         - POSTGRES_PASSWORD=caDbPass12345
         - POSTGRES_USER=postgres
         - POSTGRES_DB=fabriccaserver
      volumes:
         - ./postgres-test-data:/var/lib/postgresql/data
      ports:
         - 5432:5432
      networks:
         - basic

和我的postgresql.conf看起来像这样：

和我的hba.conf看起来像这样：

并且我创建了一个名为postgrescerts的文件夹，在其中创建了server.key，server.crt，server.csr，root.csr，root.crt，root.key。 使用以下命令：

openssl req -new -nodes -text -out root.csr -keyout root.key -subj "/CN=ica.consigner.lynkit.io"
chmod og-rwx root.key
openssl x509 -req -in root.csr -text -days 3650 -extfile /etc/ssl/openssl.cnf -extensions v3_ca -signkey root.key -out root.crt
openssl req -new -nodes -text -out server.csr -keyout server.key -subj "/CN=localhost"
chmod og-rwx server.key
openssl x509 -req -in server.csr -text -days 365 -CA root.crt -CAkey root.key -CAcreateserial -out server.crt

和我的ica日志如下：-