使用Root CA与Intermediate CA生成证书后，Peer与Orderer启动失败求助

Hey there! Let's work through this certificate validity error you're hitting when starting your Fabric peer and orderer containers. This issue almost always traces back to time mismatches or certificate configuration hiccups—here’s a step-by-step breakdown of the most effective fixes:

1. Validate Time Sync Between Host and Containers #

Docker containers typically inherit the host’s time, but occasional drift or misconfiguration can throw off certificate validity checks.

• First, check the container’s current time:

  docker exec -it <your-peer/orderer-container-name> date
  

• Compare it to your host machine’s time by running date in your terminal.
• If there’s a mismatch:
  • Restart the affected containers first—sometimes that resolves temporary sync issues.
  • For persistent fixes, add timezone sync to your docker-compose.yml for all peer/orderer services:

    environment:
      - TZ=Asia/Shanghai # Replace with your actual timezone (e.g., UTC, Europe/London)
    extra_hosts:
      - "host.docker.internal:host-gateway"
    

  • Restart the Docker daemon entirely if the above doesn’t work (sudo systemctl restart docker on Linux).

2. Check Certificate Validity Periods #

It’s possible your issued certificates have an incorrect validity window. Use OpenSSL to inspect each certificate:

• Run this command on your Root CA, Intermediate CA, and node (peer/orderer/admin/user) certificates:

  openssl x509 -in /path/to/your/certificate.pem -text -noout | grep -A 2 Validity
  

• Verify the Not Before timestamp is earlier than the current time, and Not After is far in the future.
• If validity is too short or misaligned:
  • Update your Fabric CA server config (e.g., fabric-ca-server-config.yaml) to extend expiry times:

    cfg:
      ca:
        expiry: 87600h # 10-year validity for root CA
        intermediate_expiry: 43800h # 5-year validity for intermediate CA
    

  • Restart your Root and Intermediate CA services, then re-register and re-enroll all identities to generate new, properly timed certificates.

3. Confirm Certificate Chain Integrity #

A broken certificate chain can also trigger validity errors. Ensure your nodes are loading the full trust chain (Root CA → Intermediate CA → Node certificate):

• Verify the chain using OpenSSL:

  openssl verify -CAfile /path/to/root-ca.pem -untrusted /path/to/intermediate-ca.pem /path/to/node-cert.pem
  

• If verification fails, double-check your peer/orderer config files (e.g., core.yaml for peers, orderer.yaml for orderers):
  • Ensure peer.tls.rootcert.file points to the combined Root + Intermediate CA certificate bundle.
  • Confirm peer.tls.cert.file and peer.tls.key.file reference the correct node-specific certificate and key.

4. Standardize Timezones Across All Components #

Even if the time values match, differing timezones can cause the validity check to fail.

• Set the same timezone on your host machine, CA servers, and all Docker containers. For example, on Linux hosts:

  sudo timedatectl set-timezone Asia/Shanghai
  

• As mentioned earlier, add the TZ environment variable to all your Docker services to align container timezones with the host.

5. Force Renew All Certificates #

If all else fails, a full certificate refresh might be necessary:

1. Revoke existing certificates (optional but clean):

   fabric-ca-client revoke -u http://<ca-ip>:<ca-port> -e <identity-name> -r "superseded"
   

2. Re-register each identity:

   fabric-ca-client register --id.name <peer/orderer/admin-user-name> --id.type <peer/orderer/admin/user> --id.affiliation <your-org-affiliation> -u http://<ca-ip>:<ca-port>
   

3. Re-enroll to generate fresh certificates:

   fabric-ca-client enroll -u http://<identity-name>:<registration-secret>@<ca-ip>:<ca-port> -M /path/to/msp/directory
   

4. Restart your peer and orderer containers with the new certificates.

Start with the time synchronization checks—this is the most common culprit! Let me know if any of these steps resolve your issue.

内容的提问来源于stack exchange，提问作者Trinayan