Certificate uthority

What is a Certificate Authority (CA)?

Certificate Authorities (CA) issue digital certificates that identify users or authorize user activity in the network.

Being a permissioned protocol, every actor in the Hyperledger Fabric network needs a specific identity from an authorized entity. Digital certificates issued by a CA make this possible. Encryption keys allow users to sign their transactions digitally, while digital certificates provide identity on the network.

A CA issues participants with digital certificates of the X.509 standard. See more information in the Hyperledger Fabric documentation.

For an identity to be verifiable, it must come from a trusted authority. A Membership Service Provider (MSP) is that trusted authority in Hyperledger Fabric.

What are Root and Intermediate CAs?

Root CAs contain a self-signed root certificate. Intermediate CAs have their certificates issued by the root CA or another intermediate authority, creating a chain of trust.

If an intermediate CA is compromised, only a small number of identities issued by that CA would be exposed. If the root CA is compromised, all network identities will be compromised. See chain of trust details.

How Do I Create a CA?

To create a full functioning CA within the network:

1

Create a CA

Go to the CA tab and click the Create CA button.

Step 1 — Provide a CA name (required).

Step 2 — Fill in the general information:

• Choose a CA type

• Provide the CA admin ID and password

You will need to provide the same CA admin credentials later when enrolling the CA admin.

Step 3 — Customize CA details (predefined values can be used):

• Enable debug logs if needed

• Enable TLS if required

• Choose the CA image

Using a predefined image is recommended for compatibility. If you use an image from a private repository, specify an imagePullSecret. You can create an imagePullSecret in your Kubernetes cluster with the label "app.kubernetes.io/name": "image-pull-secret".

Resources allocation:

• Requested CPU, CPU limit, Requested memory (MB), Memory limit (MB), Storage size

• Add custom environment variables if needed

Step 4 — Customize the CSR (certificate signing request):

• Provide distinguished names (Country, Locality, Organization, Organizational Unit, State or Province) if needed

• Customize path length and root CA expiry

Step 5 — Customize signing options — these values define expiry of certificates for intermediate CAs, identities, and TLS that will be enrolled with this CA.

After clicking Create, the CA node appears in the CAs list.

2

Sign an Intermediate CA (if applicable)

After creation, the intermediate CA has the "Waiting for certificate" status and cannot perform functions until it has a signed certificate.

1

Export the CSR

Go to the intermediate CA's details page, click Manage request, then Copy or Download.

2

Register an identity for the intermediate CA

Go to the parent CA, open the Identities tab, click Add identity. Provide the same name as the intermediate CA, choose type Client, select Intermediate CA, and click Register.

3

Enroll the identity (sign the CSR)

Click the Sign CSR button. Provide the identity name and password, upload or paste the CSR, then click Sign CSR.

4

Copy the parent CA's certificate

5

Upload the certificate to the intermediate CA

Open the Manage CSR window from the intermediate CA page. Upload or paste the certificate and add the parent CA's certificate.

If the parent CA was also an intermediate CA, you need to add all the intermediate certificates and the root certificate of the chain of trust.

If you want to sign your intermediate certificate by an external CA, skip steps 2 and 3 above and follow the external CA's signing procedure instead.

3

Enroll an Admin Identity

Even though the node is up and running, you need to enroll the CA admin identity using the credentials you provided during CA creation. You can check the status by the "No CA admin" label.

• Go to the CA page and click the No CA admin button, or click on the CA and then click Enroll CA admin.

• Provide the same credentials (CA admin ID and password) as entered during CA creation and submit.

After successful enrollment, you can register, enroll, and delete identities.

CA Node States

CA Details

Clicking on a CA opens a details window divided into five sections:

General Information

View the CA's URL, certificates, signing options, etc. Available actions:

• Restart CA

• Delete CA

• Edit CA (change image, resource allocation, environment variables, signing options, debug mode)

Variables

View and manage environment variables.

Identities

Displays all identities issued by this CA. Each identity shows: ID, Type, Alternative names, Certificate validity period.

Wallet

A wallet contains the CA admin identity that Catalyst Blockchain Manager uses to register and enroll identities. This identity is automatically added after enrolling.

Events and Logs

View events and logs for the CA node. Logs can be filtered by text and/or level.

How to Create an Identity?

Creating an identity consists of registering an identity and enrolling an identity.

To register or/and enroll an identity:

1. Go to the CAs tab and click on the CA you want to use.

2. Go to the Identities tab.

3. Click Add identity.

4. Provide the name and password for the identity.

5. Select a type of identity (client, peer, or orderer).

1. Select CA Admin if you want the identity to operate the CA.

2. Select Intermediate CA if you are registering an identity for an intermediate CA.

3. Select Enroll identity if needed.