<p>I am trying to set up the Fabric v2.0 test-network (<a href="https://hyperledger-fabric.readthedocs.io/en/release-2.0/test_network.html" rel="nofollow noreferrer">https://hyperledger-fabric.readthedocs.io/en/release-2.0/test_network.html</a>) on kubernetes (locally on minikube). I have an error whith <code>peer channel join</code>.</p>

<p>I created kubernetes files based on the docker-compose-test-net.yaml of the test-network. I successfully deploy the following pods:</p>

<ul>
<li>an orderer (raft)</li>
<li>2 peers (peer0-org1-example-com and peer0-org2-example-com)</li>
<li>a fabric-tools pod.</li>
</ul>

<p>I successfully generate the crypto material with cryptogen and configtxgen.</p>

<p>I successfully create the channel:
when I am in the fabric-tools pod:</p>

<pre><code>bash-5.0# peer channel create -o orderer-example-com:7050 -c $CHANNEL_NAME --ordererTLSHostnameOverride orderer.example.com -f /fabric/${CHANNEL_NAME}.tx --tls --cafile $ORDERER_CA
2020-02-11 08:10:14.057 CET [channelCmd] InitCmdFactory -&gt; INFO 001 Endorser and orderer connections initialized
2020-02-11 08:10:14.080 CET [cli.common] readBlock -&gt; INFO 002 Expect block, but got status: &amp;{NOT_FOUND}
...
2020-02-11 08:10:15.105 CET [cli.common] readBlock -&gt; INFO 00c Received block: 0
</code></pre>

<p>But when I try for the first peer to join the channel, I have an error. I have been spending days on this, and I cannot find a solution. Your help would be much appreciated!!</p>

<p>in the fabric-tools pod:</p>

<pre><code>bash-5.0# peer channel join -b $CHANNEL_NAME.block
Error: error getting endorser client for channel: endorser client failed to connect to peer0-org1-example-com:7051: failed to create new connection: context deadline exceeded
</code></pre>

<p>what I see in the peer0-org1-example-com pod logs:</p>

<pre><code>[31m2020-02-11 08:11:29.945 CET [core.comm] ServerHandshake -&gt; ERRO 1b9[0m TLS handshake failed with error remote error: tls: bad certificate server=PeerServer remoteaddress=172.17.0.6:43270
[36m2020-02-11 08:11:29.945 CET [grpc] handleRawConn -&gt; DEBU 1ba[0m grpc: Server.Serve failed to complete security handshake from "172.17.0.6:43270": remote error: tls: bad certificate
</code></pre>

<p>Thank you!!</p>

<hr>

<p>UPDATE:</p>

<p>If I run peer channel join directly on the peer0-org1-example-com pod, I can see that there is a certificate issue:</p>

<pre><code>addrConn.createTransport failed to connect to {peer0-org1-example-com:7051 0  &lt;nil&gt;}. Err :connection error: desc = "transport: authentication handshake failed: x509: certificate is valid for peer0.org1.example.com, peer0, localhost, peer0.org1.example.com, peer0, localhost, peer0.org1.example.com, peer0, localhost, not peer0-org1-example-com". Reconnecting.
</code></pre>

<p>It seems that it would accept the connection for peer0.org1.example.com but not for peer0-org1-example-com. But in Kubernetes, it does not allow me to put dots in the names of the services and the deployments, that is why I put dashes. Do you know how to solve this?
I tried to make the cryptogen tool generate certificates for peer0-org1-example-com, but it messed things up. The better would be, I think, to make kubernetes names with dots, but I can't seem to make it.</p>

<p>The names in peer deployments files:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: peer0-org1-example-com
spec:
  selector:
    matchLabels:
      name: peer0-org1-example-com
  replicas: 1
  template:
    metadata:
      labels:
        name: peer0-org1-example-com
</code></pre>

<p>The names in peer services files:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: peer0-org1-example-com
  labels:
    run: peer0-org1-example-com
spec:
  type: ClusterIP
  selector:
    name: peer0-org1-example-com
  ports:
  - protocol: TCP
    port: 7051
    name: grpc
</code></pre>

Jon - LBAB
<p>We had a similar dot/dash certificate issue with OpenShift and solved it by setting a CommonName with dashes for each Host in our crypto-config file. Maybe this will work for you too.</p>

<p>Something like this:</p>

<pre><code>PeerOrgs:
  - Name: Org1
    Domain: org1-example-com
    EnableNodeOUs: true
    Specs:
      - Hostname: peer0
        CommonName: "peer0-org1-example-com"
      - Hostname: peer1
        CommonName: "peer1-org1-example-com"

    CA:
      Hostname: ca
      CommonName: "ca-org1-example-com"
</code></pre>

<pre><code>PeerOrgs:
  - Name: Org2
    Domain: org2-example-com
    EnableNodeOUs: true
    Specs:
      - Hostname: peer0
        CommonName: "peer0-org2-example-com"
      - Hostname: peer1
        CommonName: "peer1-org2-example-com"

    CA:
      Hostname: ca
      CommonName: "ca-org2-example-com"
</code></pre>

<pre><code>OrdererOrgs:
  - Name: Orderer
    Domain: example.com
    EnableNodeOUs: true
    Specs:
      - Hostname: orderer
        CommonName: "orderer-example-com"
</code></pre>

<p>UPDATE:
We also changed all dot addresses in the configtx.yaml like this:</p>

<pre><code>Orderer: &amp;OrdererDefaults
    ...
    EtcdRaft:
        Consenters:
        - Host: orderer-example-com
    ...
    Addresses:
        - orderer-example-com:7050
</code></pre>

<p>UPDATE 2:
probably you have to change the csr part in the fabric-ca-server-config.yaml of each org too:</p>

<pre><code>csr:
   cn: ca-example-com
   names:
      - C: US
        ST: "New York"
        L: "New York"
        O: example-com
        OU:
   hosts:
     - localhost
     - example-com
   ca:
      expiry: 131400h
      pathlength: 1
</code></pre>

<pre><code>csr:
   cn: ca-org1-example-com
   names:
      - C: US
        ST: "North Carolina"
        L: "Durham"
        O: org1-example-com
        OU:
   hosts:
     - localhost
     - org1-example-com
   ca:
      expiry: 131400h
      pathlength: 1
</code></pre>

<pre><code>csr:
   cn: ca-org2-example-com
   names:
      - C: UK
        ST: "Hampshire"
        L: "Hursley"
        O: org2-example-com
        OU:
   hosts:
     - localhost
     - org2-example-com
   ca:
      expiry: 131400h
      pathlength: 1
</code></pre>
