Problem with Enabling TLS Certificates

[bcdebusk]

When I enable TLS (as per the example):

export MICROFAB_CONFIG='{
"port": 8443,
"tls": {
"enabled": true
}
}'

docker run -p 8443:8443 -e MICROFAB_CONFIG ibmcom/ibp-microfab

I get the following startup error(s):

[ org1peer] 2022-08-18 17:48:22.030 UTC 0032 ERRO [comm.tls] ClientHandshake -> Client TLS handshake failed after 2.06779ms with error: x509: certificate relies on legacy Common Name field, use SANs instead remoteaddress=127.0.0.1:8443
2022/08/18 17:48:22 http: TLS handshake error from 127.0.0.1:39176: remote error: tls: bad certificate
2022/08/18 17:48:23 http: TLS handshake error from 127.0.0.1:39178: remote error: tls: bad certificate
[ org1peer] 2022-08-18 17:48:23.055 UTC 0033 ERRO [comm.tls] ClientHandshake -> Client TLS handshake failed after 4.131417ms with error: x509: certificate relies on legacy Common Name field, use SANs instead remoteaddress=127.0.0.1:8443

Any ideas?

[bcdebusk]

Any help here? It's been two weeks.

I'm using out-of-the-box microfab and starting it with an example straight out of the github home page:

export MICROFAB_CONFIG='{
"port": 8443,
"tls": {
"enabled": true
}
}'

docker run -p 8443:8443 -e MICROFAB_CONFIG ibmcom/ibp-microfab

... and it doesn't startup.

[mbwhite]

Hello - sorry for the lack of input on this; folks have been busy with the upcoming HGF workshop (which will feature microfab).

This TLS error is related to updated checks on the use of common names vs SAN in the x509 certs. A fix for which has so far eluded me.

Generally though microfab is run without TLS as it's aimed at the development end of the use cases. If we can resolve we will.. but at this point I'm not sure what the exact fix is.

[FrancescoPasquaRelatech]

I'd like to add that a working TLS implementation would be very helpful in order to use IBM Microfab with the Hyperledger Explorer.

[mbwhite]

@FrancescoPasquaRelatech well it's just good timing that I merged changes yesterday that I hope should enable TLS support...
FYI @bcdebusk - the scripts/test-container.sh shows the TLS being used.

I'd like to get a final release out before we move to Hyperledger Labs - but if you want to rebuild the code locally ahead of time then please do...