Chang'an chain learning notes - certificate model of certificate research

This article has participated in 「 Open source star picking program 」, Welcome to join us . Activity Links ：https://github.com/weopenprojects/WeOpen-Star

Chang'an chain learning notes - Certificate mode of certificate research

In the first article , We know how to download the source code of the certificate tool , And compile the certificate tool , But when generating the certificate , We generate it based on scripts , The whole is a black box , We don't know what's going on inside , So this chapter is mainly to study the black box .

1. Certificate configuration template

Chang'an chain has three certificate configuration templates :

(1) Certificate mode

(2） Public key identity mode

(3） Public chain mode

2. Certificate mode

（1） The configuration template

/root/chainmaker-learn/chainmaker-go/tools/chainmaker-cryptogen/config/crypto_config_template.yml

crypto_config:
 - domain: chainmaker.org
 host_name: wx-org
 count: 4 #  If 1, Use it directly host_name, Otherwise, add an incremental number
# pk_algo: sm2
pk_algo: ecc_p256
ski_hash: sha256
#pkcs11 To configure
pkcs11:
 enabled: false
 library: /usr/local/lib64/pkcs11/libupkcs11.so
 label: HSM
 password: 11111111
 session_cache_size: 10
 hash: "SHA256" # hash algorithm used to compute SKI
specs: &specs_ref
 expire_year: 10
 sans:
 - chainmaker.org
 - localhost
 - 127.0.0.1
location: &location_ref
 country: CN
 locality: Beijing
 province: Beijing
# CA Certificate configuration
ca:
 location:
 <<: *location_ref
 specs:
 <<: *specs_ref
#  Node certificate configuration
node:
 - type: consensus
 #  Number of consensus nodes
 count: 1
 #  Consensus node configuration
 location:
 <<: *location_ref
 specs:
 <<: *specs_ref
 expire_year: 5
 - type: common
 #  Number of ordinary nodes
 count: 1
 #  Common node configuration
 location:
 <<: *location_ref
 specs:
 <<: *specs_ref
 expire_year: 5
user:
 - type: admin
 #  Number of administrator certificates
 count: 1
 #  Administrator certificate configuration
 location:
 <<: *location_ref
 expire_year: 5
 - type: client
 #  Number of ordinary user certificates
 count: 1
 #  Common user certificate configuration
 location:
 <<: *location_ref
 expire_year: 5
 - type: light
 #  Number of user certificates of light nodes
 count: 1
 #  Light node user certificate configuration
 location:
 <<: *location_ref
 expire_year: 5


（2） Generate Certificate

Our husband has obtained a certificate , See which certificates have been generated

./chainmaker-cryptogen generatetree -L 3 crypto-config/

3. Meaning analysis of certificate and template

By generating certificates , We can study the meaning of each field of the configuration template

(1)  Number of organizations

-domain: chainmaker.org

• host_name: wx-org

• count: 4 #  If 1, Use it directly host_name, Otherwise, add an incremental number

adopt count You can configure the number of organizations , Each organization name is defined by host_name +domain form ,  among host_name Later, a number will be spelled according to the number of organizations .

（2） There are three directories under each node , Configure by the corresponding configuration

Namely ca Catalog ,Node Catalog ,User Catalog , These three directories represent three types of certificates

CA certificate :  It can be a root CA certificate 、 middle CA certificate 、 Since the signing CA certificate , The other two types of certificates use CA Certificate signature generation .

Node Certificate :  It is divided into consensus nodes 、 Ordinary node certificate .

User certificate :  It is divided into administrator user certificate 、 Ordinary user certificate 、 Light node user certificate .