跨机器多Peer的Composer网络身份激活失败及连接配置验证

我在两台独立机器上部署2个Peer以搭建Hyperledger Composer网络时，遇到了一个问题：使用为第二个Peer颁发的身份执行网络ping操作时，收到「身份必须激活」的错误。

执行composer identity list -c alice-org1@bl-security-network后，输出如下：

List all identities in the business network
- $class: org.hyperledger.composer.system.Identity
  identityId: 5254561bf2038c3f2764785ec6407d5c108b6cb59f9e4df071dd37b83748abe8
  name: admin
  issuer: ac3dbcbe135ba48b29f97665bb103f8260c38d3872473e584314392797c595f3
  certificate: """
-----BEGIN CERTIFICATE-----
MIICATCCAaigAwIBAgIUCMlRQ75ytdGtgVj/O5F6pXgqv9kwCgYIKoZIzj0EAwIw
czELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
biBGcmFuY2lzY28xGTAXBgNVBAoTEG9yZzEuZXhhbXBsZS5jb20xHDAaBgNVBAMT
E2NhLm9yZzEuZXhhbXBsZS5jb20wHhcNMTgwNTE2MDgxNjAwWhcNMTkwNTE2MDgy
MTAwWjAhMQ8wDQYDVQQLEwZjbGllbnQxDjAMBgNVBAMTBWFkbWluMFkwEwYHKoZI
zj0CAQYIKoZIzj0DAQcDQgAEGcw0GV/K/L5VCmJLS/ngZsR2vq7xrKVhPt5AeoVX
Lgjv0aO6IxxTiialnWOdEIpFAlogu1BNSHoGFn8SDryJzaNsMGowDgYDVR0PAQH/
BAQDAgeAMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFDt6FVgrod+MFmOf8tdyw6dH
a0HKMCsGA1UdIwQkMCKAIFoSZq5xVRFtKJ6+doWFMgMxQsitU4s7BZ4ST0dpkFLt
MAoGCCqGSM49BAMCA0cAMEQCIC9XpIvaw+hnYLTHHYoUjTjrWiRQMD6991EPYZ/6
v4x1AiAKVVD5T7WXvrm05N4ThdpUS1BeBSCor4Wgm0fQC8ekeg==
-----END CERTIFICATE-----
"""
  state: ACTIVATED
  participant: resource:org.hyperledger.composer.system.NetworkAdmin#alice-org1
- $class: org.hyperledger.composer.system.Identity
  identityId: 6fdff74bf0ada91fb4a095114d8fa2a4547faabf7b2e9580b5d8a1ebb800d13f
  name: admin
  issuer: 07290d7a00cf1fca27f0c98491478ecc0c65ced2caedfa6e0c000f80caaf50e4
  certificate: """
-----BEGIN CERTIFICATE-----
MIICAjCCAaigAwIBAgIUNnm7Rls6K5Ay0trODVa8CXQxtyIwCgYIKoZIzj0EAwIw
czELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDVNh
biBGcmFuY2lzY28xGTAXBgNVBAoTEG9yZzIuZXhhbXBsZS5jb20xHDAaBgNVBAMT
E2NhLm9yZzIuZXhhbXBsZS5jb20wHhcNMTgwNTE2MDgxNjAwWhcNMTkwNTE2MDgy
MTAwWjAhMQ8wDQYDVQQLEwZjbGllbnQxDjAMBgNVBAMTBWFkbWluMFkwEwYHKoZI
zj0CAQYIKoZIzj0DAQcDQgAE1y8zJ+6ZjO5VV6/oG+qCQzGyII62AujhNkyDapp2
TlylMtlDX6VODtLmiXNjdlPi63NKUGYkKqoCAJh3efX866NsMGowDgYDVR0PAQH/
BAQDAgeAMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFMDKuUnac7KX/b7qSZ1x9tbD
0EC+MCsGA1UdIwQkMCKAIESSjMUlSEPHYNOLB9sm9pQsNYZzaqm8kY0Qwg47EzSI
MAoGCCqGSM49BAMCA0gAMEUCIQCbAYneZofBVmQJHdcyJl0GDTS3FhZ1Zw7+TO/I
NnF2IAIgMBO2zKPCg7ygkIPPrPLVnuJN1f9LmEZQmkXV1xaiqao=
-----END CERTIFICATE-----
"""
  state: BOUND
  participant: resource:org.hyperledger.composer.system.NetworkAdmin#bob-org2
Command succeeded

从输出可以看到，为第二个Peer颁发的bob-org2身份状态为BOUND而非ACTIVATED，这正是ping失败的直接原因。下面分两部分解决问题：

一、激活BOUND状态的身份 #

BOUND状态表示身份已经关联到对应的参与者，但尚未被授权使用。你需要使用具有网络管理员权限的身份（比如alice-org1的admin身份）执行激活命令：

方法1：通过身份名称激活 #

composer identity activate -c alice-org1@bl-security-network -i admin -s adminpw --identityName admin --participant resource:org.hyperledger.composer.system.NetworkAdmin#bob-org2

方法2：通过identityId激活 #

如果你不确定名称，直接使用输出中的identityId更可靠：

composer identity activate -c alice-org1@bl-security-network -i admin -s adminpw --identityId 6fdff74bf0ada91fb4a095114d8fa2a4547faabf7b2e9580b5d8a1ebb800d13f

执行完成后，再次运行composer identity list确认该身份状态变为ACTIVATED，之后再尝试网络ping操作。

二、验证连接配置文件的正确性 #

你提供的连接配置文件整体符合跨机器部署的场景，但需要检查以下几个关键点：

{
  "name": "my-net",
  "x-type": "hlfv1",
  "version": "1.0.0",
  "client": {
    "organization": "Org2",
    "connection": {
      "timeout": {
        "peer": {
          "endorser": "200",
          "eventHub": "200",
          "eventReg": "200"
        },
        "orderer": "300"
      }
    }
  },
  "channels": {
    "mychannel": {
      "orderers": [ "orderer.example.com" ],
      "peers": {
        "peer0.org1.example.com": {
          "endorsingPeer": true,
          "chaincodeQuery": true,
          "eventSource": true
        },
        "peer0.org2.example.com": {
          "endorsingPeer": true,
          "chaincodeQuery": true,
          "eventSource": true
        }
      }
    }
  },
  "organizations": {
    "Org1": {
      "mspid": "Org1MSP",
      "peers": [ "peer0.org1.example.com" ],
      "certificateAuthorities": [ "ca.org1.example.com" ]
    },
    "Org2": {
      "mspid": "Org2MSP",
      "peers": [ "peer0.org2.example.com" ],
      "certificateAuthorities": [ "ca.org2.example.com" ]
    }
  },
  "orderers": {
    "orderer.example.com": {
      "url": "grpcs://20.20.20.23:7050",
      "grpcOptions": { "ssl-target-name-override": "orderer.example.com" },
      "tlsCACerts": { "pem": "INSERT_ORDERER_CA_CERT" }
    }
  },
  "peers": {
    "peer0.org1.example.com": {
      "url": "grpcs://20.20.20.23:8051",
      "eventUrl": "grpcs://20.20.20.23:8053",
      "grpcOptions": { "ssl-target-name-override": "peer0.org1.example.com" },
      "tlsCACerts": { "pem": "INSERT_ORG1_CA_CERT" }
    },
    "peer0.org2.example.com": {
      "url": "grpcs://localhost:9051",
      "eventUrl": "grpcs://localhost:9053",
      "grpcOptions": { "ssl-target-name-override": "peer0.org2.example.com" },
      "tlsCACerts": { "pem": "INSERT_ORG2_CA_CERT" }
    }
  },
  "certificateAuthorities": {
    "ca.org1.example.com": {
      "url": "https://20.20.20.23:7054",
      "caName": "ca.example.com",
      "httpOptions": { "verify": false }
    },
    "ca.org2.example.com": {
      "url": "https://localhost:8054",
      "caName": "ca1.example.com",
      "httpOptions": { "verify": false }
    }
  }
}

需要核对的配置项： #

1. TLS证书占位符：所有INSERT_XXX_CERT的位置必须替换为对应的CA证书内容（Orderer CA、Org1 CA、Org2 CA的PEM格式证书），不能保留占位符，否则会导致TLS握手失败。
2. 端口与网络连通性：
   • 确认20.20.20.23机器上的Orderer（7050）、Peer0.org1（8051/8053）、CA.org1（7054）端口已开放，且本机（Org2）能通过这些端口访问到对应服务（可以用telnet 20.20.20.23 7050测试连通性）。
   • 本机的Peer0.org2（9051/9053）、CA.org2（8054）端口映射正确，Docker容器正常运行。
3. SSL目标名称匹配：ssl-target-name-override的值必须与对应服务（Orderer、Peer）证书中的Common Name（CN）完全一致，否则会触发TLS证书验证失败。
4. CA的caName：ca.org1.example.com的caName为ca.example.com，ca.org2.example.com为ca1.example.com，需要确认两台机器上的CA服务配置中的caName与之一致，否则后续身份注册可能失败。

总结 #

优先解决身份激活问题，这是导致ping失败的直接原因；再逐一验证连接配置的正确性，确保网络连通和证书配置无误。完成这些步骤后，应该就能正常使用bob-org2的身份访问网络了。

内容的提问来源于stack exchange，提问作者Louis Shekhtman