Fabric Node SDK 2.2连接Amazon Managed Blockchain报错排查

故障场景 #

• 客户端部署在Cloud9实例，基础环境配置完成，Docker容器内的Fabric CLI可正常连接Peer节点
• 使用Fabric Node.js SDK建立网络连接时持续失败

初始测试代码 #

'use strict';

const FabricCAServices = require('fabric-ca-client');
const { Wallets, Gateway, X509Identity, User } = require('fabric-network');
const fs = require('fs');
const path = require('path');
const yaml = require('js-yaml');

const ccpPath = path.resolve(__dirname, 'connection_profile.yaml');
const ccp = yaml.load(fs.readFileSync(ccpPath, 'utf8'));

async function main() {
  try {
    const walletPath = path.join(process.cwd(), 'wallet');
    const wallet = await Wallets.newFileSystemWallet(walletPath);
    const gateway = new Gateway();
    const gatewayOptions = {identity: 'admin', wallet: wallet, discovery: {enabled: true, asLocalhost: false }}
    await gateway.connect(ccp, gatewayOptions);
    const network = await gateway.getNetwork('mychannel');
  } catch (error) {
    console.error(`Some error is occurred: ${error.stack}`);
    process.exit(1);
  }
}

main();

初始连接配置（connection_profile.yaml） #

配置中/home/ec2-user/admin-msp/admincerts/cert.pem为按照AWS官方指南注册admin身份时生成的证书文件，完整配置如下：

name: "ABC"
x-type: hlfv1
version: "1.0"

channels:
  mychannel:
    orderers:
      - ABCOrderer
    peers:
      peer1:
        endorsingPeer: true
        chaincodeQuery: true
        ledgerQuery: true
        eventSource: true

organizations:
  abc:
    mspid: m-***
    peers:
      - peer1
    certificateAuthorities:
      - abc

orderers:
  ABCOrderer:
    url: grpcs://orderer.n-***.managedblockchain.ap-northeast-1.amazonaws.com:30001
    grpcOptions:
      ssl-target-name-override: orderer.n-***.managedblockchain.ap-northeast-1.amazonaws.com
    tlsCACerts:
      # path: /home/ec2-user/managedblockchain-tls-chain.pem
      path: /home/ec2-user/admin-msp/admincerts/cert.pem

peers:
  peer1:
    url: grpcs://nd-***.managedblockchain.ap-northeast-1.amazonaws.com:30003
    eventUrl: grpcs://nd-***.managedblockchain.ap-northeast-1.amazonaws.com:30004
    grpcOptions:
      ssl-target-name-override: nd-***.managedblockchain.ap-northeast-1.amazonaws.com
    tlsCACerts:
      # path: /home/ec2-user/managedblockchain-tls-chain.pem
      path: /home/ec2-user/admin-msp/admincerts/cert.pem

certificateAuthorities:
  abc:
    url: https://ca.m-***.managedblockchain.ap-northeast-1.amazonaws.com:30002
    httpOptions:
      verify: true
    tlsCACerts:
      # path: /home/ec2-user/managedblockchain-tls-chain.pem
      path: /home/ec2-user/admin-msp/admincerts/cert.pem
    caName: m-***

报错表现 #

代码启动3秒后，控制台先后输出Peer节点、Orderer节点连接超时日志，最终抛出异常：
TypeError: Cannot read property 'toArray' of null #

排查过程 #

• 首先怀疑连接配置文件格式或字段错误，对照AWS官方提供的connection-profile模板调整配置，问题未解决
• 多次替换节点TLS证书配置，先后尝试AWS提供的managedblockchain-tls-chain.pem、CA为admin签发的身份证书，报错无变化
• 后续定位到可能是文件钱包中存储的admin身份信息错误，补充了向CA发起enroll请求、将admin身份写入钱包的逻辑，代码如下：

const caURL = ccp.certificateAuthorities['abc'].url;
const ca = new FabricCAServices(caURL);
const enrollment = await ca.enroll({ enrollmentID: 'admin', enrollmentSecret: 'Adminpassword' });

const X509Identity = {
  credentials: {
    certificate: enrollment.certificate,
    privateKey: enrollment.rootCertificate,
  },
  mspId: ccp.organizations['abc'].mspid,
  type: 'X.509',
};
// 初始化文件系统钱包存储身份信息
const walletPath = path.join(process.cwd(), 'wallet');
const wallet = await Wallets.newFileSystemWallet(walletPath);
await wallet.put('admin', X509Identity);

根因与修复方案 #

根因 #

写入钱包的X509身份对象中，privateKey字段取值错误，误将根证书内容传入私钥字段，导致Gateway连接节点时无法生成有效签名，节点拒绝连接，最终触发连接超时和签名逻辑空指针报错。

修复方法 #

修改身份写入钱包的代码，将privateKey字段的取值从enrollment.rootCertificate替换为enrollment.key.toBytes()，正确传入CA签发的用户私钥内容即可解决问题，修正后的身份配置片段：

const X509Identity = {
  credentials: {
    certificate: enrollment.certificate,
    privateKey: enrollment.key.toBytes(),
  },
  mspId: ccp.organizations['abc'].mspid,
  type: 'X.509',
};

额外配置提示：连接配置文件中orderer、peer、CA节点的tlsCACerts.path字段需要配置为Amazon Managed Blockchain提供的TLS根证书managedblockchain-tls-chain.pem，不能使用admin用户的身份证书，否则会触发TLS握手失败。

内容的提问来源于stack exchange，提问作者KhoaHV