Fabric系列 - SoftHSM 软件模拟HSM

在 fabric-ca-server 上使用软件模拟的 HSM(密码卡) 功能

安装 SoftHSMv2

教程 SoftHSMv2

默认的配置文件 /etc/softhsm2.conf
默认的token目录 /var/lib/softhsm/tokens/

初始化和启动fabric-ca-server，需要设置一个管理员用户的名称和密码

初始化令牌

# 初始化一个即可
softhsm2-util --init-token --slot 0 --label "fabric"=== SO PIN (4-255 characters) ===Please enter SO PIN: 71811222Please reenter SO PIN: 71811222=== User PIN (4-255 characters) ===Please enter user PIN: 71811222Please reenter user PIN: 71811222The token has been initialized and is reassigned to slot 423405613softhsm2-util --init-token --slot 1 --label "fabric"=== SO PIN (4-255 characters) ===Please enter SO PIN: 111111Please reenter SO PIN: 111111=== User PIN (4-255 characters) ===Please enter user PIN: 222222Please reenter user PIN: 222222The token has been initialized and is reassigned to slot 121977387#查看softhsm2-util --show-slots

配置fabric-ca-server的配置文件`fabric-ca-server-config.yaml`

bccsp:default: PKCS11sw:hash: SHA2security: 256filekeystore:keystore: msp/keystorepkcs11:Library: /usr/local/lib/softhsm/libsofthsm2.soPin: "222222"Label: fabrichash: SHA2security: 256Immutable: false

启动 fabric-ca-server

#模式一: 新创建证书, 再启动  (私钥会保管在HSM中)
rm ./config-hsm/ca-cert.pem
fabric-ca-server init -b admin:adminpw -H config-hsmfabric-ca-server start -b admin:adminpw -H config-hsm#模式二: 指定已事先生成好的证书目录
fabric-ca-server start -b admin:adminpw -H /etc/hyperledger/fabric-ca-server-config

查看 fabric-ca-server.db

sudo apt-get install sqlite3
sqlite3 config-hsm\fabric-ca-server.db
sqlite> .tables
# 查用户表 (用户admin已经在数据库里。这是Fabric CA启动时生成的)
sqlite> select * from users;
# 使用 enroll 命令登记admin后,才会生成证书
sqlite> select * from certificates;