Fabric系列 - SoftHSM 软件模拟HSM

news2025/5/15 1:19:50

在 fabric-ca-server 上使用软件模拟的 HSM(密码卡) 功能

安装 SoftHSMv2

教程 SoftHSMv2

默认的配置文件 /etc/softhsm2.conf
默认的token目录 /var/lib/softhsm/tokens/

初始化和启动fabric-ca-server，需要设置一个管理员用户的名称和密码

初始化令牌

# 初始化一个即可
softhsm2-util --init-token --slot 0 --label "fabric"
	
	=== SO PIN (4-255 characters) ===
	Please enter SO PIN: 71811222
	Please reenter SO PIN: 71811222
	=== User PIN (4-255 characters) ===
	Please enter user PIN: 71811222
	Please reenter user PIN: 71811222
	The token has been initialized and is reassigned to slot 423405613

softhsm2-util --init-token --slot 1 --label "fabric"
	=== SO PIN (4-255 characters) ===
	Please enter SO PIN: 111111
	Please reenter SO PIN: 111111
	=== User PIN (4-255 characters) ===
	Please enter user PIN: 222222
	Please reenter user PIN: 222222
	The token has been initialized and is reassigned to slot 121977387


	#查看
	softhsm2-util --show-slots

配置fabric-ca-server的配置文件`fabric-ca-server-config.yaml`

bccsp:
    default: PKCS11
    sw:
        hash: SHA2
        security: 256
        filekeystore:
            keystore: msp/keystore
    pkcs11:
        Library: /usr/local/lib/softhsm/libsofthsm2.so
        Pin: "222222"
        Label: fabric
        hash: SHA2
        security: 256
        Immutable: false

启动 fabric-ca-server

#模式一: 新创建证书, 再启动  (私钥会保管在HSM中)
rm ./config-hsm/ca-cert.pem
fabric-ca-server init -b admin:adminpw -H config-hsm

fabric-ca-server start -b admin:adminpw -H config-hsm

#模式二: 指定已事先生成好的证书目录
fabric-ca-server start -b admin:adminpw -H /etc/hyperledger/fabric-ca-server-config

查看 fabric-ca-server.db

sudo apt-get install sqlite3
sqlite3 config-hsm\fabric-ca-server.db
sqlite> .tables
# 查用户表 (用户admin已经在数据库里。这是Fabric CA启动时生成的)
sqlite> select * from users;
# 使用 enroll 命令登记admin后,才会生成证书
sqlite> select * from certificates;