I am new to hyperledger fabric, I have one problem about gossip's remote peer authentication. Because our server is in internal network(can't access internet), we need to setup a nginx before our peer node, assume that one orderer, 2 org, every org just has one peer, peer0.org1(peer01), peer0.org2(peer02), peer0.org1 is our internal peer node, and it needs to route by nginx include gossip and enable mtls. if we have peer0.org2's private key and cert, it should works, the config like below.
peer01 nginx{
ssl_certificate peer02 server crt;
ssl_certificate_key peer02 server key;
ssl_client_certificate peer01 client ca crt;
location / {
grpc_pass to peer02
grpc_ssl_certificate peer01 client crt;
grpc_ssl_certificate_key peer01 client key;
grpc_ssl_trusted_certificate peer02 server ca.crt;
}
But actually we can't have peer0.org2's private key, so we try to use peer01's ca cert assign peer0.org2'cert and key which belong to peer01, peer01-peer02.crt, peer01-peer02.key.
peer01 nginx{
ssl_certificate peer01-peer02 server crt;
ssl_certificate_key peer01-peer02 server key;
ssl_client_certificate peer01 client ca crt;
location / {
grpc_pass to peer02
grpc_ssl_certificate peer01 client crt;
grpc_ssl_certificate_key peer01 client key;
grpc_ssl_trusted_certificate peer02 server ca.crt;
}
But in fabric gossip source code, we found that we can't do this enter image description here
it will verify the hash between remote cert(I think it get from the channel) and reveive msg'cert, so finally occur error and won't work.
my solution is that delete these verify codes and rebuild the docker, but I don't know rebuild which docker images can work, is that fabric-peer, can some guys tell me that each docker in fabric will use what package in source code? or can tell me the more better solution than modify the source code? I must say that we need to use tls. many thx.