Breadcrumbs

CryptoServer PKCS#11 Configuration in Fabric Container

  1. Go inside the running container using the command below.

›_ Console 

# docker exec -it 8dc5d676844b /bin/bash
image-3286040768-1.jpg

Docker container

Here the value 8dc5d676844b is the container ID from section 4.3.3 Verifying the Status of the Container.

›_ Console 

root@8dc5d676844b:/# ls -la
image-3286040768-2.jpg

Container/Directory

  1. Copy the newly generated binaries fabric-ca-server and fabric-ca-client from host machine's /root/go/src/github.com/hyperledger/fabric-ca/bin directory to container's /go/bin directory.

›_ Console 

root@Fabric-CA: # cd /root/go/src/github.com/hyperledger/fabric-ca/bin root@Fabric-CA:~/go/src/github.com/hyperledger/fabric-ca/bin# docker cp fabric-ca-client demo:/go/bin 

root@Fabric-CA:~/go/src/github.com/hyperledger/fabric-ca/bin# docker cp fabric-ca-server demo:/go/bin
image-3286040768-3.jpg

Copy binary files

  1. Verify the above binary files are copied at /go/bin inside the container.

›_ Console 

root@8dc5d676844b:/go/bin# ll
image-3286040768-4.jpg

Verified binary files

  1. Install vim editor with apt-get commands inside the container as shown below.

›_ Console 

# apt-get update 

# apt-get install vim 

# cd /etc/utimaco
image-3286040768-5.jpg

Updating container

image-3286040768-6.jpg

Installing vim editor

  1. Open the cs_pkcs11_R3.cfg file inside the container with vim editor and make the following changes.

›_ Console 

# vim cs_pkcs11_R3.cfg

cs_pkcs11_R3.cfg 

[Global]  

# For unix:  

Logpath = /tmp  

# Loglevel (0 = NONE; 1 = ERROR; 2 = WARNING; 3 = INFO; 4 = TRACE)  Logging = 1 

Keepalive = true 

MultiInitReturnsCKR_OK = true 

# Set the Device to connect with  

[CryptoServer] # Device specifier  Device = <HSM_I

For more information regarding the commands and command parameters please check the Utimaco CryptoServer documentation. The device may be a CryptoServer (PCIe or LAN) device. The device line will follow one of these patterns, based on the HSM form-factor:

Device = 288@<HSM IP address> Hardware (LAN) HSM

OR Device = /dev/cs2.0 Hardware (PCIe) HSM

To make your testing easier, it would be good to enable the PKCS#11 log file. That can be enabled by editing the Logging Loglevel. Set the LogPath and Logging Loglevel to 1. For testing you may want to increase it to 4.

The added LogPath points to a writable directory, not to a file.

If you encounter problems, check the log file named cs_pkcs11_R3.log in the LogPath defined directory. When you are done testing, you should change Logging to 1 or 2. This will limit the logging to only critical and important messages.