fabric-ca-server-config.yaml 7.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195
  1. #############################################################################
  2. # This is a configuration file for the fabric-ca-server command.
  3. #
  4. # COMMAND LINE ARGUMENTS AND ENVIRONMENT VARIABLES
  5. # ------------------------------------------------
  6. # Each configuration element can be overridden via command line
  7. # arguments or environment variables. The precedence for determining
  8. # the value of each element is as follows:
  9. # 1) command line argument
  10. # Examples:
  11. # a) --port 443
  12. # To set the listening port
  13. # b) --ca-keyfile ../mykey.pem
  14. # To set the "keyfile" element in the "ca" section below;
  15. # note the '-' separator character.
  16. # 2) environment variable
  17. # Examples:
  18. # a) FABRIC_CA_SERVER_PORT=443
  19. # To set the listening port
  20. # b) FABRIC_CA_SERVER_CA_KEYFILE="../mykey.pem"
  21. # To set the "keyfile" element in the "ca" section below;
  22. # note the '_' separator character.
  23. # 3) configuration file
  24. # 4) default value (if there is one)
  25. # All default values are shown beside each element below.
  26. #
  27. # FILE NAME ELEMENTS
  28. # ------------------
  29. # All filename elements below end with the word "file".
  30. # For example, see "certfile" and "keyfile" in the "ca" section.
  31. # The value of each filename element can be a simple filename, a
  32. # relative path, or an absolute path. If the value is not an
  33. # absolute path, it is interpretted as being relative to the location
  34. # of this configuration file.
  35. #
  36. #############################################################################
  37. # Server's listening port (default: 7054)
  38. port: 7054
  39. # Enables debug logging (default: false)
  40. debug: false
  41. #############################################################################
  42. # TLS section for the server's listening port
  43. #############################################################################
  44. tls:
  45. # Enable TLS (default: false)
  46. enabled: true
  47. # TLS for the server's listening port
  48. certfile: peerOrg1-cert.pem
  49. keyfile: 331cc9c5fc570a5f0f88537ca49196a0158618a9411d051dc67e8ac9fcee03a2_sk
  50. #############################################################################
  51. # The CA section contains information related to the Certificate Authority
  52. # including the name of the CA, which should be unique for all members
  53. # of a blockchain network. It also includes the key and certificate files
  54. # used when issuing enrollment certificates (ECerts) and transaction
  55. # certificates (TCerts).
  56. # The chainfile (if it exists) contains the certificate chain which
  57. # should be trusted for this CA, where the 1st in the chain is always the
  58. # root CA certificate.
  59. #############################################################################
  60. ca:
  61. # Name of this CA
  62. name:
  63. # Key file (default: ca-key.pem)
  64. keyfile: ca-key.pem
  65. # Certificate file (default: ca-cert.pem)
  66. certfile: ca-cert.pem
  67. # Chain file (default: chain-cert.pem)
  68. chainfile: ca-chain.pem
  69. #############################################################################
  70. # The registry section controls how the fabric-ca-server does two things:
  71. # 1) authenticates enrollment requests which contain a username and password
  72. # (also known as an enrollment ID and secret).
  73. # 2) once authenticated, retrieves the identity's attribute names and
  74. # values which the fabric-ca-server optionally puts into TCerts
  75. # which it issues for transacting on the Hyperledger Fabric blockchain.
  76. # These attributes are useful for making access control decisions in
  77. # chaincode.
  78. # There are two main configuration options:
  79. # 1) The fabric-ca-server is the registry
  80. # 2) An LDAP server is the registry, in which case the fabric-ca-server
  81. # calls the LDAP server to perform these tasks.
  82. #############################################################################
  83. registry:
  84. # Maximum number of times a password/secret can be reused for enrollment
  85. # (default: 0, which means there is no limit)
  86. maxEnrollments: 0
  87. # Contains user information which is used when LDAP is disabled
  88. identities:
  89. - name: admin
  90. pass: adminpw
  91. type: client
  92. affiliation: ""
  93. attrs:
  94. hf.Registrar.Roles: "client,user,peer,validator,auditor,ca"
  95. hf.Registrar.DelegateRoles: "client,user,validator,auditor"
  96. hf.Revoker: true
  97. hf.IntermediateCA: true
  98. #############################################################################
  99. # Database section
  100. # Supported types are: "sqlite3", "postgres", and "mysql".
  101. # The datasource value depends on the type.
  102. # If the type is "sqlite3", the datasource value is a file name to use
  103. # as the database store. Since "sqlite3" is an embedded database, it
  104. # may not be used if you want to run the fabric-ca-server in a cluster.
  105. # To run the fabric-ca-server in a cluster, you must choose "postgres"
  106. # or "mysql".
  107. #############################################################################
  108. db:
  109. type: sqlite3
  110. datasource: fabric-ca-server.db
  111. tls:
  112. enabled: false
  113. certfiles: db-server-cert.pem # Comma Separated (e.g. root.pem, root2.pem)
  114. client:
  115. certfile: db-client-cert.pem
  116. keyfile: db-client-key.pem
  117. #############################################################################
  118. # LDAP section
  119. # If LDAP is enabled, the fabric-ca-server calls LDAP to:
  120. # 1) authenticate enrollment ID and secret (i.e. username and password)
  121. # for enrollment requests;
  122. # 2) To retrieve identity attributes
  123. #############################################################################
  124. ldap:
  125. # Enables or disables the LDAP client (default: false)
  126. enabled: false
  127. # The URL of the LDAP server
  128. url: ldap://<adminDN>:<adminPassword>@<host>:<port>/<base>
  129. tls:
  130. certfiles: ldap-server-cert.pem # Comma Separated (e.g. root.pem, root2.pem)
  131. client:
  132. certfile: ldap-client-cert.pem
  133. keyfile: ldap-client-key.pem
  134. #############################################################################
  135. # Affiliation section
  136. #############################################################################
  137. affiliations:
  138. org1:
  139. - department1
  140. - department2
  141. org2:
  142. - department1
  143. #############################################################################
  144. # Signing section
  145. #############################################################################
  146. signing:
  147. profiles:
  148. ca:
  149. usage:
  150. - cert sign
  151. expiry: 8000h
  152. caconstraint:
  153. isca: true
  154. default:
  155. usage:
  156. - cert sign
  157. expiry: 8000h
  158. ###########################################################################
  159. # Certificate Signing Request section for generating the CA certificate
  160. ###########################################################################
  161. csr:
  162. cn: fabric-ca-server
  163. names:
  164. - C: US
  165. ST: "North Carolina"
  166. L:
  167. O: Hyperledger
  168. OU: Fabric
  169. hosts:
  170. - d49dbadd50a8
  171. ca:
  172. pathlen:
  173. pathlenzero:
  174. expiry:
  175. #############################################################################
  176. # Crypto section configures the crypto primitives used for all
  177. #############################################################################
  178. crypto:
  179. software:
  180. hash_family: SHA2
  181. security_level: 256
  182. ephemeral: false
  183. key_store_dir: keys