What is the difference between CA Certificate and the TLS certificate in Fabric CA Server?

user_2204000 0
Viewed 1486

I have seen in the fabric-ca-server binary there are some options including and I am unsure why two certfiles are needed. Why can't we just use tls.certfile?

--ca.certfile string  PEM-encoded CA certificate file (default "ca-cert.pem")

                                  
--tls.certfile string  PEM-encoded TLS certificate file for server's listening port (default "tls-cert.pem")

Also, I saw in the following file list showing the two cert files.

-rw-r--r-- 1 root   root   61440 Aug  7 05:43 fabric-ca-server.db
-rw-r--r-- 1 root   root     932 Aug  7 05:43 tls-cert.pem
-rw-r--r-- 1 root   root     215 Aug  7 05:43 IssuerRevocationPublicKey
-rw-r--r-- 1 root   root     843 Aug  7 05:43 IssuerPublicKey
-rw-r--r-- 1 root   root     806 Aug  7 05:43 ca-cert.pem
drwxr-xr-x 6 root   root    4096 Jul 23 08:07 msp
-rwxrwxr-x 1 ubuntu ubuntu 16044 Jul 20 07:40 fabric-ca-server-config.yaml

Why are two cert files needed for CA functions, since this is basically a TLS functionality?

hyperledger-fabric
1 Answers

In Fabric, there are generally two types of certificates -- signer certs, and TLS certs.

For your specific question -- the Fabric CA server needs a certificate with which to issue certificates (the CA cert), and a certificate with which to negotiate TLS connections. These are definitely different functions and should use different certificates.

For a little more background:

TLS certs are used for, as you might imagine, TLS negotiations. These certificates are used to ensure the network link integrity between components. With standard TLS, clients are assured that the server they are connecting to is in fact the server they intended, and not another party pretending to be their destination. When mutual TLS is enabled, the server can also authenticate that the client is authorized to form TLS links, in addition to the standard client->server assurances from standard TLS.

Signer certs are used for transacting on the Fabric network. Clients use their signer cert to sign proposals sent to peers and transactions sent to orderers, peers use their signer certs to sign proposal responses (create endorsements), and orderers use their signer certs to sign blocks which are disseminated back to peers and clients. When you see a reference to a 'certificate' which is not explicitly noted to be TLS, usually, this certificate is a signer cert.

These two classes of certificate are different because of the different functions they perform. Additionally, in cryptography it is generally frowned upon to use the same private key in independent cryptography schemes, as it substantially increases the surface area for attacks.

user_83651520
Related