Purpose of csr hosts in fabric ca config

user_10836490 0
Viewed 76

What is the purpose of csr.hosts in fabric-ca-server-config.yaml ? For ex, see below

csr:
   cn: ca-org1
   names:
      - C: US
        ST: "New York"
        L: "New York"
        O: ca-org1
        OU: ca-org1
   hosts:
     - localhost
     - example.com
     - ca-org1
   ca:
      expiry: 131400h
      pathlength: 1

Are they used to assign a domain name to the CA server itself or used to point node hostnames which are trying to register or enroll ca identities using CA server as fabric-ca client?

Thanks in advance

hyperledger-fabric-ca hyperledger-fabric
1 Answers

I came here looking for the answer but eventually found it myself.

According to the docs:

All of the fields above pertain to the X.509 signing key and certificate which is generated by the fabric-ca-server init.

So as I understand it, hosts correspond to the hosts that the CA certificate is valid for.

If run the server binary fabric-ca-server init --help, one of the flags descriptions is the csr.hosts provided below: --csr.hosts strings A list of comma-separated host names in a certificate signing request to a parent fabric-ca-server.

So assuming another Root CA sign this CA's csr, csr.hosts tells the Root CA which hosts are valid.

user_102695150
Related