./fabric-ca-client register -d -u https://org1rootcaadmin:[email protected]:7055 --id.name org1intermediatecaadmin --id.secret org1intermediatecaadminpw  --id.attrs '"hf.Registrar.Roles=user,admin","hf.Revoker=true","hf.IntermediateCA=true"' --tls.certfiles /usr/project/fabric-ca/org1-ca/tls-ca/ca-cert.pem --mspdir /usr/project/fabric-ca/org1-ca/org1-root-ca/org1rootcaadmin/msp

2022/03/09 03:07:34 [INFO] 192.168.0.105:48152 POST /register 403 76 "Registration of 'org1intermediatecaadmin' failed"
2022/03/09 03:07:55 [DEBUG] Cleaning up expired nonces for CA 'org1-root-ca'
2022/03/09 03:09:27 [DEBUG] Received request for /register
2022/03/09 03:09:27 [DEBUG] Caller is using a x509 certificate
2022/03/09 03:09:27 [DEBUG] Certicate Dates: NotAfter = 2023-03-09 07:49:00 +0000 UTC NotBefore = 2022-03-09 07:41:00 +0000 UTC 
2022/03/09 03:09:27 [INFO] 192.168.0.105:48154 POST /register 401 26 "Untrusted certificate: Failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "x509: ECDSA verification failure" while trying to verify candidate authority certificate "fabric-ca-server")"
2022/03/09 03:09:45 [DEBUG] Received request for /register
2022/03/09 03:09:45 [DEBUG] Caller is using a x509 certificate
2022/03/09 03:09:45 [DEBUG] Certicate Dates: NotAfter = 2023-03-09 07:53:00 +0000 UTC NotBefore = 2022-03-09 07:47:00 +0000 UTC 
2022/03/09 03:09:45 [DEBUG] Checking for revocation/expiration of certificate owned by 'org1rootcaadmin'
2022/03/09 03:09:45 [DEBUG] DB: Get certificate by serial (533f2c5a6619663debbad716a74be3cb577f1875) and aki (db3b6bd4a8420c090d3715e69803b5861391d2e7)
2022/03/09 03:09:45 [DEBUG] DB: Getting identity org1rootcaadmin
2022/03/09 03:09:45 [DEBUG] Successful token authentication of 'org1rootcaadmin'
2022/03/09 03:09:45 [DEBUG] Received registration request from org1rootcaadmin: { Name:org1intermediatecaadmin Type:client Secret:**** MaxEnrollments:0 Affiliation: Attributes:[{hf.Registrar.Roles user,admin false} {hf.Revoker true false} {hf.IntermediateCA true false}] CAName:  }
2022/03/09 03:09:45 [DEBUG] No affiliation provided in registration request, will default to using registrar's affiliation of ''
2022/03/09 03:09:45 [DEBUG] canRegister - Check to see if user 'org1rootcaadmin' can register
2022/03/09 03:09:45 [DEBUG] Checking to see if caller 'org1rootcaadmin' can act on type 'client'
2022/03/09 03:09:45 [DEBUG] Checking to see if caller 'org1rootcaadmin' is a registrar
2022/03/09 03:09:45 [DEBUG] Registrar is not allowed to register user 'org1intermediatecaadmin': Failed to verify if user can act on type: 'org1rootcaadmin' is not a registrar
2022/03/09 03:09:45 [INFO] 192.168.0.105:48156 POST /register 403 76 "Registration of 'org1intermediatecaadmin' failed"

peer channel create -c mychannel -f /tmp/hyperledger/org1/peer1/assets/channel.tx -o orderer1-org0:7050 --outputBlock /tmp/hyperledger/org1/peer1/assets/mychannel.block --tls --cafile /tmp/hyperledger/org1/peer1/tls-msp/tlscacerts/tls-0-0-0-0-7052.pem

/lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.28' not found (required by bin/fabric-ca-server)

% make fabric-ca-client
# golang.org/x/sys/unix
vendor/golang.org/x/sys/unix/syscall_darwin.1_13.go:29:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.go:27:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.1_13.go:40:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:28:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:43:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:59:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:75:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:90:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:105:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:121:3: //go:linkname must refer to declared function or variable
vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go:121:3: too many errors

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.6 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ uname -a
Linux fabric01 5.4.0-159-generic #176-Ubuntu SMP Mon Aug 14 12:03:34 UTC 2023 s390x s390x s390x GNU/Linux

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ go version
go version go1.20.7 linux/s390x

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ git checkout v1.5.7
Previous HEAD position was d575f40e This PR brings the following: - prepare the revocation handle as expected by the idemix lib - idemix: export revocation handle in SignerConfig - update idemix and mathlib dep - add logs to idemix issuer - doc update
HEAD is now at 86c6b463 Release commit for v1.5.7

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ make fabric-ca-client
Building fabric-ca-client in bin directory ...
# github.com/IBM/mathlib/driver/kilic
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:137:2: undefined: mul
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:148:2: undefined: mul
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:152:2: undefined: mul
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:155:2: undefined: mul
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:156:2: undefined: mul
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:158:2: undefined: mul
vendor/github.com/IBM/mathlib/driver/kilic/custom.go:327:2: undefined: mul
make: *** [Makefile:106: bin/fabric-ca-client] Error 1

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ git checkout v1.5.6
Previous HEAD position was 86c6b463 Release commit for v1.5.7
HEAD is now at 47a32f27 Release commit for v1.5.6 (#358)

barry@fabric01:~/go/src/github.com/silliman/fabric-ca$ make fabric-ca-client
Building fabric-ca-client in bin directory ...
Built bin/fabric-ca-client

	CurveID                  string `def:"CurveID" skip:"true" help:"Name of the curve among {'amcl.Fp256bn', 'gurvy.Bn254', 'amcl.Fp256Miraclbn'}, defaults to 'amcl.Fp256bn'"`

Go 1.10+ installation
GOPATH environment variable is set correctly
libtool and libtdhl-dev packages are installed

go get -u github.com/hyperledger/fabric-ca/cmd/...

Note: If you have already cloned the fabric-ca repository, make sure you are on the master branch before running the ‘go get’ command above. Otherwise, you might see the following error:

2021/08/13 09:09:16 [ERROR] Error occurred initializing database: Failed to open sqlite3 DB: Binary was compiled with 'CGO_ENABLED=0', go-sqlite3 requires cgo to work. This is a stub

./bin/fabric-ca-server version
fabric-ca-server:
 Version: 1.5.1-snapshot-6d7c103a
 Go version: go1.15.7
 OS/Arch: linux/amd64

fabric-ca-server:
 Version: 1.5.0
 Go version: go1.16
 OS/Arch: linux/amd64

Structural error at definitions.identityInfo.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 37
Semantic error at definitions.identityInfo.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 37
Structural error at paths./api/v1/enroll.post.parameters.2.schema.properties.profile.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 262
Semantic error at paths./api/v1/enroll.post.parameters.2.schema.properties.profile.type
Schema "type" key must be a string
Jump to line 262
Structural error at paths./api/v1/enroll.post.parameters.2.schema.properties.label.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 269
Semantic error at paths./api/v1/enroll.post.parameters.2.schema.properties.label.type
Schema "type" key must be a string
Jump to line 269
Structural error at paths./api/v1/enroll.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 276
Semantic error at paths./api/v1/enroll.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 276
Structural error at paths./api/v1/idemix/cri.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 621
Semantic error at paths./api/v1/idemix/cri.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 621
Structural error at paths./api/v1/reenroll.post.parameters.2.schema.properties.profile.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 740
Semantic error at paths./api/v1/reenroll.post.parameters.2.schema.properties.profile.type
Schema "type" key must be a string
Jump to line 740
Structural error at paths./api/v1/reenroll.post.parameters.2.schema.properties.label.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 747
Semantic error at paths./api/v1/reenroll.post.parameters.2.schema.properties.label.type
Schema "type" key must be a string
Jump to line 747
Structural error at paths./api/v1/reenroll.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 754
Semantic error at paths./api/v1/reenroll.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 754
Structural error at paths./api/v1/register.post.parameters.2.schema.properties.secret.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 929
Semantic error at paths./api/v1/register.post.parameters.2.schema.properties.secret.type
Schema "type" key must be a string
Jump to line 929
Structural error at paths./api/v1/register.post.parameters.2.schema.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 936
Semantic error at paths./api/v1/register.post.parameters.2.schema.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 936
Structural error at paths./api/v1/register.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 972
Semantic error at paths./api/v1/register.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 972
Structural error at paths./api/v1/revoke.post.parameters.2.schema.properties.id.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1091
Semantic error at paths./api/v1/revoke.post.parameters.2.schema.properties.id.type
Schema "type" key must be a string
Jump to line 1091
Structural error at paths./api/v1/revoke.post.parameters.2.schema.properties.aki.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1098
Semantic error at paths./api/v1/revoke.post.parameters.2.schema.properties.aki.type
Schema "type" key must be a string
Jump to line 1098
Structural error at paths./api/v1/revoke.post.parameters.2.schema.properties.serial.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1105
Semantic error at paths./api/v1/revoke.post.parameters.2.schema.properties.serial.type
Schema "type" key must be a string
Jump to line 1105
Structural error at paths./api/v1/revoke.post.parameters.2.schema.properties.reason.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1112
Semantic error at paths./api/v1/revoke.post.parameters.2.schema.properties.reason.type
Schema "type" key must be a string
Jump to line 1112
Structural error at paths./api/v1/revoke.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1119
Semantic error at paths./api/v1/revoke.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 1119
Structural error at paths./api/v1/revoke.post.parameters.2.schema.properties.gencrl.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1126
Semantic error at paths./api/v1/revoke.post.parameters.2.schema.properties.gencrl.type
Schema "type" key must be a string
Jump to line 1126
Structural error at paths./api/v1/gencrl.post.parameters.2.schema.properties.revokedafter.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1256
Semantic error at paths./api/v1/gencrl.post.parameters.2.schema.properties.revokedafter.type
Schema "type" key must be a string
Jump to line 1256
Structural error at paths./api/v1/gencrl.post.parameters.2.schema.properties.revokedbefore.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1263
Semantic error at paths./api/v1/gencrl.post.parameters.2.schema.properties.revokedbefore.type
Schema "type" key must be a string
Jump to line 1263
Structural error at paths./api/v1/gencrl.post.parameters.2.schema.properties.expireafter.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1270
Semantic error at paths./api/v1/gencrl.post.parameters.2.schema.properties.expireafter.type
Schema "type" key must be a string
Jump to line 1270
Structural error at paths./api/v1/gencrl.post.parameters.2.schema.properties.expirebefore.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1277
Semantic error at paths./api/v1/gencrl.post.parameters.2.schema.properties.expirebefore.type
Schema "type" key must be a string
Jump to line 1277
Structural error at paths./api/v1/gencrl.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1284
Semantic error at paths./api/v1/gencrl.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 1284
Structural error at paths./api/v1/affiliations.post.parameters.3.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1495
Semantic error at paths./api/v1/affiliations.post.parameters.3.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 1495
Structural error at paths./api/v1/affiliations/{affiliation}.put.parameters.4.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1728
Semantic error at paths./api/v1/affiliations/{affiliation}.put.parameters.4.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 1728
Structural error at paths./api/v1/identities.get.responses.200.schema.properties.result.properties.identities.items.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 1956
Semantic error at paths./api/v1/identities.get.responses.200.schema.properties.result.properties.identities.items.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 1956
Structural error at paths./api/v1/identities.post.parameters.2.schema.properties.secret.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2093
Semantic error at paths./api/v1/identities.post.parameters.2.schema.properties.secret.type
Schema "type" key must be a string
Jump to line 2093
Structural error at paths./api/v1/identities.post.parameters.2.schema.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2100
Semantic error at paths./api/v1/identities.post.parameters.2.schema.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 2100
Structural error at paths./api/v1/identities.post.parameters.2.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2136
Semantic error at paths./api/v1/identities.post.parameters.2.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 2136
Structural error at paths./api/v1/identities.post.responses.201.schema.properties.result.properties.secret.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2173
Semantic error at paths./api/v1/identities.post.responses.201.schema.properties.result.properties.secret.type
Schema "type" key must be a string
Jump to line 2173
Structural error at paths./api/v1/identities.post.responses.201.schema.properties.result.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2180
Semantic error at paths./api/v1/identities.post.responses.201.schema.properties.result.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 2180
Structural error at paths./api/v1/identities/{id}.get.responses.200.schema.properties.result.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2325
Semantic error at paths./api/v1/identities/{id}.get.responses.200.schema.properties.result.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 2325
Structural error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.secret.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2458
Semantic error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.secret.type
Schema "type" key must be a string
Jump to line 2458
Structural error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2465
Semantic error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 2465
Structural error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.attrs.items.properties.value.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2486
Semantic error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.attrs.items.properties.value.type
Schema "type" key must be a string
Jump to line 2486
Structural error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.caname.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2503
Semantic error at paths./api/v1/identities/{id}.put.parameters.3.schema.properties.caname.type
Schema "type" key must be a string
Jump to line 2503
Structural error at paths./api/v1/identities/{id}.put.responses.200.schema.properties.result.properties.secret.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2535
Semantic error at paths./api/v1/identities/{id}.put.responses.200.schema.properties.result.properties.secret.type
Schema "type" key must be a string
Jump to line 2535
Structural error at paths./api/v1/identities/{id}.put.responses.200.schema.properties.result.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2542
Semantic error at paths./api/v1/identities/{id}.put.responses.200.schema.properties.result.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 2542
Structural error at paths./api/v1/identities/{id}.delete.responses.200.schema.properties.result.properties.max_enrollments.type
should be equal to one of the allowed values
allowedValues: array, boolean, integer, number, object, string
Jump to line 2692
Semantic error at paths./api/v1/identities/{id}.delete.responses.200.schema.properties.result.properties.max_enrollments.type
Schema "type" key must be a string
Jump to line 2692

db.SetMaxOpenConns(25)
db.SetMaxIdleConns(25)
db.SetConnMaxLifetime(5*time.Minute)

==> Cloning hyperledger/fabric-samples repo
Cloning into 'fabric-samples'...
remote: Enumerating objects: 7688, done.
remote: Total 7688 (delta 0), reused 0 (delta 0), pack-reused 7688
Receiving objects: 100% (7688/7688), 4.50 MiB | 18.43 MiB/s, done.
Resolving deltas: 100% (4020/4020), done.
fabric-samples v2.3.2 does not exist, defaulting main

Pull Hyperledger Fabric binaries

===> Downloading version 2.3.2 platform specific fabric binaries
===> Downloading:  https://github.com/hyperledger/fabric/releases/download/v2.3.2/hyperledger-fabric-linux-amd64-2.3.2.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   649  100   649    0     0   3294      0 --:--:-- --:--:-- --:--:--  3294
100 73.5M  100 73.5M    0     0  33.1M      0  0:00:02  0:00:02 --:--:-- 40.3M
==> Done.
===> Downloading version 1.5.0 platform specific fabric-ca-client binary
===> Downloading:  https://github.com/hyperledger/fabric-ca/releases/download/v1.5.0/hyperledger-fabric-ca-linux-amd64-1.5.0.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100     9  100     9    0     0     47      0 --:--:-- --:--:-- --:--:--    47

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
==> There was an error downloading the binary file.

------> 1.5.0 fabric-ca-client binary is not available to download  (Available from 1.1.0-rc1) <----

2022-06-22T05:00:05.813188931Z 2022/06/22 05:00:05 [INFO] signed certificate with serial number 227295963368738719576295504100228910397990236259
2022-06-22T05:00:05.856018279Z 2022/06/22 05:00:05 [INFO] 172.30.14.166:60118 POST /api/v1/reenroll 201 0 "OK"
2022-06-22T05:00:06.047488264Z 2022/06/22 05:00:06 [INFO] signed certificate with serial number 443761956686633821028606532772396696503568673733
2022-06-22T05:00:06.099787377Z 2022/06/22 05:00:06 [INFO] 172.30.14.166:60120 POST /api/v1/reenroll 201 0 "OK"
2022-06-22T05:00:06.192780584Z 2022/06/22 05:00:06 [INFO] 172.30.16.22:49800 POST /api/v1/register 401 26 "Untrusted certificate: Failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2021-06-28T12:58:30Z is before 2021-11-18T08:08:00Z"
2022-06-22T05:23:28.755945128Z 2022/06/22 05:23:28 [INFO] 172.30.16.22:47926 POST /api/v1/register 401 26 "Untrusted certificate: Failed to verify certificate: x509: certificate has expired or is not yet valid: current time 2021-06-28T12:58:30Z is before 2021-11-18T08:08:00Z"

reenrollIgnoreCertExpiry := ctx.endpoint.Path == "reenroll" && ctx.ca.Config.CA.ReenrollIgnoreCertExpiry

// Make sure the caller's cert was issued by this CA
err2 = ca.VerifyCertificate(cert, reenrollIgnoreCertExpiry)
if err2 != nil {
	return "", caerrors.NewAuthenticationErr(caerrors.ErrUntrustedCertificate, "Untrusted certificate: %s", err2)
}

func (ca *CA) VerifyCertificate(cert *x509.Certificate, forceTime bool) error {
	log.Debugf("Certicate Dates: NotAfter = %s NotBefore = %s \n", cert.NotAfter.String(), cert.NotBefore.String())

	opts, err := ca.getVerifyOptions()
	if err != nil {
		return errors.WithMessage(err, "Failed to get verify options")
	}

	// force check time to be 30 seconds after certificate start time to ensure expiry doesn't get flagged
	// this is one of the checks that is made on the certificate in Verify()
	if forceTime {
		opts.CurrentTime = cert.NotBefore.Add(time.Duration(time.Second * 30))
	}

func (ca *CA) getVerifyOptions() (*x509.VerifyOptions, error) {
	if ca.verifyOptions != nil {
		return ca.verifyOptions, nil
	}

- &org1

   Name: org1

   ID: org1MSP

   MSPDir: /tmp/hyperledger/org1/msp

   AnchorPeers:
      - Host: peer1-org1
         Port: 7051

- &org1

   Name: org1

   ID: org1MSP

   MSPDir: /tmp/hyperledger/org1/msp

   AnchorPeers:
      - Host: peer1-org1
      - Port: 7051

 x509: certificate is valid for tls_ca, not org_ca

$ /opt/cloudhsm/bin/cloudhsm_mgmt_util /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg
aws-cloudhsm>loginHSM CO admin password
aws-cloudhsm>createUser CU fabric 12345678

bccsp:
  default: PKCS11
  pkcs11:
      Library: /opt/cloudhsm/lib/libcloudhsm_pkcs11.so
      Pin: 'fabric:12345678'
      AltId: FABRIC
      # it seems that the label must be the name of the HSM cluster in AWS:
      Label: cluster-dzetr75hznp
      hash: SHA2
      security: 256

$ fabric-ca-server init -b admin:adminpw
2021/10/07 02:46:58 [INFO] Configuration file location: /opt/hsmtest/ca.hsm/rootca/fabric-ca-server-config.yaml
2021/10/07 02:46:59 [INFO] Server Version: 1.5.2
2021/10/07 02:46:59 [INFO] Server Levels: &{Identity:2 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1}
2021/10/07 02:46:59 [WARNING] &{69 The specified CA certificate file /opt/hsmtest/ca.hsm/rootca/ca-cert.pem does not exist}
2021/10/07 02:46:59 [INFO] generating key: &{A:ecdsa S:256}
2021/10/07 02:46:59 [INFO] encoded CSR
2021/10/07 02:46:59 [INFO] signed certificate with serial number 457077676613156083610706603201870637828122354856
2021/10/07 02:46:59 [INFO] The CA key and certificate were generated for CA rootca
2021/10/07 02:46:59 [INFO] The key was stored by BCCSP provider 'PKCS11'
2021/10/07 02:46:59 [INFO] The certificate is at: /opt/hsmtest/ca.hsm/rootca/ca-cert.pem
2021/10/07 02:46:59 [INFO] Initialized sqlite3 database at /opt/hsmtest/ca.hsm/rootca/fabric-ca-server.db
2021/10/07 02:46:59 [INFO] The issuer key was successfully stored. The public key is at: /opt/hsmtest/ca.hsm/rootca/IssuerPublicKey, secret key is at: /opt/hsmtest/ca.hsm/rootca/msp/keystore/IssuerSecretKey
2021/10/07 02:46:59 [INFO] Idemix issuer revocation public and secret keys were generated for CA 'rootca'
2021/10/07 02:46:59 [INFO] The revocation key was successfully stored. The public key is at: /opt/hsmtest/ca.hsm/rootca/IssuerRevocationPublicKey, private key is at: /opt/hsmtest/ca.hsm/rootca/msp/keystore/IssuerRevocationPrivateKey
2021/10/07 02:46:59 [INFO] Home directory for default CA: /opt/hsmtest/ca.hsm/rootca
2021/10/07 02:46:59 [INFO] Initialization was successful

$ /etc/hyperledger/fabric-ca-client# fabric-ca-server start -d
2021/10/07 02:52:10 [DEBUG] Home directory: /opt/hsmtest/ca.hsm/rootca
2021/10/07 02:52:10 [INFO] Configuration file location: /opt/hsmtest/ca.hsm/rootca/fabric-ca-server-config.yaml
2021/10/07 02:52:10 [INFO] Starting server in home directory: /opt/hsmtest/ca.hsm/rootca
2021/10/07 02:52:10 [DEBUG] Set log level: 
2021/10/07 02:52:10 [INFO] Server Version: 1.5.2
2021/10/07 02:52:10 [INFO] Server Levels: &{Identity:2 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1}
2021/10/07 02:52:10 [DEBUG] Making server filenames absolute
2021/10/07 02:52:10 [DEBUG] Initializing default CA in directory /opt/hsmtest/ca.hsm/rootca
2021/10/07 02:52:10 [DEBUG] CA Home Directory: /opt/hsmtest/ca.hsm/rootca
2021/10/07 02:52:10 [DEBUG] Checking configuration file version '1.4.7' against server version: '1.5.2'
2021/10/07 02:52:10 [DEBUG] Initializing BCCSP: &{ProviderName:PKCS11 SwOpts:0xc000394150 PluginOpts:<nil> Pkcs11Opts:0xc000143000}
2021/10/07 02:52:10 [DEBUG] Initializing BCCSP with software options &{SecLevel:256 HashFamily:SHA2 FileKeystore:0xc00016ccd0 DummyKeystore:<nil> InmemKeystore:<nil>}
2021/10/07 02:52:10 [DEBUG] Initializing BCCSP with PKCS11 options {SecLevel:256 HashFamily:SHA2 Ephemeral:false FileKeystore:<nil> DummyKeystore:<nil> Library:/opt/cloudhsm/lib/libcloudhsm_pkcs11.so Label:****** Pin:****** SoftVerify:false Immutable:false AltId:FABRIC}
2021/10/07 02:52:10 [DEBUG] Initialize key material
2021/10/07 02:52:10 [DEBUG] Making CA filenames absolute
2021/10/07 02:52:10 [INFO] The CA key and certificate already exist
2021/10/07 02:52:10 [INFO] The key is stored by BCCSP provider 'PKCS11'
2021/10/07 02:52:10 [INFO] The certificate is at: /opt/hsmtest/ca.hsm/rootca/ca-cert.pem
2021/10/07 02:52:10 [DEBUG] Loading CN from existing enrollment information
2021/10/07 02:52:10 [DEBUG] Initializing DB
2021/10/07 02:52:10 [DEBUG] Initializing 'sqlite3' database at '/opt/hsmtest/ca.hsm/rootca/fabric-ca-server.db'
2021/10/07 02:52:10 [DEBUG] Using sqlite database, connect to database in home (/opt/hsmtest/ca.hsm/rootca/fabric-ca-server.db) directory
2021/10/07 02:52:10 [DEBUG] Creating SQLite database (/opt/hsmtest/ca.hsm/rootca/fabric-ca-server.db) if it does not exist...
2021/10/07 02:52:10 [DEBUG] Creating users table if it does not exist
2021/10/07 02:52:10 [DEBUG] Creating affiliations table if it does not exist
2021/10/07 02:52:10 [DEBUG] Creating certificates table if it does not exist
2021/10/07 02:52:10 [DEBUG] Creating credentials table if it does not exist
2021/10/07 02:52:10 [DEBUG] Creating revocation_authority_info table if it does not exist
2021/10/07 02:52:10 [DEBUG] Creating nonces table if it does not exist
2021/10/07 02:52:10 [DEBUG] Creating properties table if it does not exist
2021/10/07 02:52:10 [DEBUG] Successfully opened sqlite3 DB
2021/10/07 02:52:10 [DEBUG] Initializing identity registry
2021/10/07 02:52:10 [DEBUG] Initialized DB identity registry
2021/10/07 02:52:10 [DEBUG] Checking database levels '&{Identity:2 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1}' against server levels '&{Identity:2 Affiliation:1 Certificate:1 Credential:1 RAInfo:1 Nonce:1}'
2021/10/07 02:52:10 [DEBUG] Loading identity table
2021/10/07 02:52:10 [DEBUG] Loading identity 'admin_ca'
2021/10/07 02:52:10 [DEBUG] DB: Getting identity admin_ca
2021/10/07 02:52:10 [DEBUG] Identity 'admin_ca' already registered, loaded identity
2021/10/07 02:52:10 [DEBUG] Successfully loaded identity table
2021/10/07 02:52:10 [DEBUG] Loading affiliations table
2021/10/07 02:52:10 [DEBUG] Successfully loaded affiliations table
2021/10/07 02:52:10 [INFO] Initialized sqlite3 database at /opt/hsmtest/ca.hsm/rootca/fabric-ca-server.db
2021/10/07 02:52:10 [DEBUG] Initializing enrollment signer
2021/10/07 02:52:10 [DEBUG] validating configuration
2021/10/07 02:52:10 [DEBUG] validate local profile
2021/10/07 02:52:10 [DEBUG] profile is valid
2021/10/07 02:52:10 [DEBUG] validate local profile
2021/10/07 02:52:10 [DEBUG] profile is valid
2021/10/07 02:52:10 [DEBUG] validate local profile
2021/10/07 02:52:10 [DEBUG] profile is valid
2021/10/07 02:52:10 [DEBUG] CA initialization successful
2021/10/07 02:52:10 [DEBUG] Initializing Idemix issuer...
2021/10/07 02:52:10 [INFO] The Idemix issuer public and secret key files already exist
2021/10/07 02:52:10 [INFO]    secret key file location: /opt/hsmtest/ca.hsm/rootca/msp/keystore/IssuerSecretKey
2021/10/07 02:52:10 [INFO]    public key file location: /opt/hsmtest/ca.hsm/rootca/IssuerPublicKey
2021/10/07 02:52:10 [DEBUG] Intializing revocation authority for issuer 'rootca'
2021/10/07 02:52:10 [DEBUG] Initialize Idemix issuer revocation key material
2021/10/07 02:52:10 [INFO] The Idemix issuer revocation public and secret key files already exist
2021/10/07 02:52:10 [INFO]    private key file location: /opt/hsmtest/ca.hsm/rootca/msp/keystore/IssuerRevocationPrivateKey
2021/10/07 02:52:10 [INFO]    public key file location: /opt/hsmtest/ca.hsm/rootca/IssuerRevocationPublicKey
2021/10/07 02:52:10 [DEBUG] Intializing nonce manager for issuer 'rootca'
2021/10/07 02:52:10 [INFO] Home directory for default CA: /opt/hsmtest/ca.hsm/rootca
2021/10/07 02:52:10 [DEBUG] 1 CA instance(s) running on server
2021/10/07 02:52:10 [INFO] Operation Server Listening on 127.0.0.1:9443
2021/10/07 02:52:10 [DEBUG] TLS is enabled
2021/10/07 02:52:10 [DEBUG] TLS enabled but either certificate or key file does not exist, automatically generating TLS credentials
2021/10/07 02:52:10 [DEBUG] TLS CSR: {<PRIVATE STUFF>}
2021/10/07 02:52:10 [DEBUG] GenCSR &{<PRIVATE STUFF>}
2021/10/07 02:52:10 [DEBUG] Initializing client with config: &{URL: MSPDir: TLS:{Enabled:false CertFiles:[] Client:{KeyFile: CertFile:}} Enrollment:{ Name: Secret:**** CAName: AttrReqs:[] Profile: Label: CSR:<nil> Type:  } CSR:{CN: Names:[] Hosts:[] KeyRequest:<nil> CA:<nil> SerialNumber:} ID:{Name: Type: Secret: MaxEnrollments:0 Affiliation: Attributes:[] CAName:} Revoke:{Name: Serial: AKI: Reason: CAName: GenCRL:false} CAInfo:{CAName:} CAName: CSP:0xc000147fb0 Debug:false LogLevel:}
2021/10/07 02:52:10 [DEBUG] Initializing BCCSP: &{ProviderName:PKCS11 SwOpts:0xc000394150 PluginOpts:<nil> Pkcs11Opts:0xc000143000}
2021/10/07 02:52:10 [DEBUG] Initializing BCCSP with software options &{SecLevel:256 HashFamily:SHA2 FileKeystore:0xc00016ccd0 DummyKeystore:<nil> InmemKeystore:<nil>}
2021/10/07 02:52:10 [DEBUG] Initializing BCCSP with PKCS11 options {SecLevel:256 HashFamily:SHA2 Ephemeral:false FileKeystore:<nil> DummyKeystore:<nil> Library:/opt/cloudhsm/lib/libcloudhsm_pkcs11.so Label:****** Pin:****** SoftVerify:false Immutable:false AltId:FABRIC}
2021/10/07 02:52:10 [INFO] generating key: &{A:ecdsa S:256}
2021/10/07 02:52:10 [DEBUG] generate key from request: algo=ecdsa, size=256
2021/10/07 02:52:10 [DEBUG] failed generating BCCSP key: Failed generating ECDSA P256 key: P11: keypair generate failed [pkcs11: 0x13: CKR_ATTRIBUTE_VALUE_INVALID]
2021/10/07 02:52:10 [DEBUG] Closing server DBs
Error: Failed to automatically generate TLS certificate and key: Failed to generate CSR: Failed generating ECDSA P256 key: P11: keypair generate failed [pkcs11: 0x13: CKR_ATTRIBUTE_VALUE_INVALID]

2021-10-07T02:52:10.204+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::connection::connection_pool] Adding HSM connection to connection pool: HsmConnection { hsm_info: HSM { IP: "10.4.1.189", Port: 2223 } }
2021-10-07T02:52:10.209+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::hsm_connection::server_connection::common] Initializing new connection: HSM { IP: "10.4.1.189", Port: 2223 }
2021-10-07T02:52:10.260+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::hsm_connection::server_properties] Version handshake with server succeeded. Received version: ComponentVersion { major: 2, minor: 3 }
2021-10-07T02:52:10.260+02:00 INFO  [179] ThreadId(5) [hsm1_marshaling::server_handshake] Reporting sdk version Pkcs11:5.2-1-bionic:CodeBuildBatchProject-uFu5sNXfquqK:ed9a3dbd-7172-439f-8ee3-79408d4e3f39
2021-10-07T02:52:10.304+02:00 WARN  [179] ThreadId(3) [cloudhsm_provider::hsm1::hsm_connection::dispatcher_strategy] UX000: Discarding HSM response because it does not match a pending request.
2021-10-07T02:52:10.352+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::connection::connection_pool] Adding HSM connection to connection pool: HsmConnection { hsm_info: HSM { IP: "10.4.1.236", Port: 2223 } }
2021-10-07T02:52:10.355+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::hsm_connection::server_connection::common] Initializing new connection: HSM { IP: "10.4.1.236", Port: 2223 }
2021-10-07T02:52:10.401+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::hsm_connection::server_properties] Version handshake with server succeeded. Received version: ComponentVersion { major: 2, minor: 3 }
2021-10-07T02:52:10.401+02:00 INFO  [179] ThreadId(5) [hsm1_marshaling::server_handshake] Reporting sdk version Pkcs11:5.2-1-bionic:CodeBuildBatchProject-uFu5sNXfquqK:ed9a3dbd-7172-439f-8ee3-79408d4e3f39
2021-10-07T02:52:10.444+02:00 WARN  [179] ThreadId(1) [cloudhsm_provider::hsm1::hsm_connection::dispatcher_strategy] UX000: Discarding HSM response because it does not match a pending request.
2021-10-07T02:52:10.492+02:00 INFO  [179] ThreadId(3) [cloudhsm_provider::hsm1::connection::connection_pool::cluster_info_message] Cluster version 150321984 is up to date. Ignoring cluster version received: 150321671.
2021-10-07T02:52:10.492+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::connection::device] Retrieving HSM information.
2021-10-07T02:52:10.513+02:00 INFO  [179] ThreadId(5) [cloudhsm_provider::hsm1::connection::session_creation] Successfully created session with id: ProviderSessionId { inner: 1 }
2021-10-07T02:52:10.560+02:00 ERROR [179] ThreadId(6) [cloudhsm_pkcs11::general::C_Initialize] BP000: Library is already initialized.
2021-10-07T02:52:10.560+02:00 ERROR [179] ThreadId(6) [cloudhsm_pkcs11::general::C_Initialize] C_Initialize failed, returning 0x00000191
2021-10-07T02:52:10.560+02:00 INFO  [179] ThreadId(6) [cloudhsm_provider::hsm1::connection::device] Retrieving HSM information.
2021-10-07T02:52:10.581+02:00 INFO  [179] ThreadId(6) [cloudhsm_provider::hsm1::connection::session_creation] Successfully created session with id: ProviderSessionId { inner: 2 }
2021-10-07T02:52:10.582+02:00 ERROR [179] ThreadId(6) [cloudhsm_provider::hsm1::session::authentication] Failed to login to HSM. 2 connections failed, out of 2. Returning first error from HSM { IP: "10.4.1.236", Port: 2223 }, AlreadyLoggedIn.
2021-10-07T02:52:10.582+02:00 ERROR [179] ThreadId(6) [cloudhsm_pkcs11::session::C_Login] Error: User is already logged in
2021-10-07T02:52:10.582+02:00 ERROR [179] ThreadId(6) [cloudhsm_pkcs11::session::C_Login] C_Login failed, returning 0x00000100
2021-10-07T02:52:10.587+02:00 ERROR [179] ThreadId(6) [cloudhsm_pkcs11::keymgmt::C_GenerateKeyPair::error] Attribute Value for (Unknown) is invalid
2021-10-07T02:52:10.587+02:00 ERROR [179] ThreadId(6) [cloudhsm_pkcs11::keymgmt::C_GenerateKeyPair] C_GenerateKeyPair failed, returning 0x00000013