title: TLS handshake failed with error remote error: tls: bad certificate server=Orderer remoteaddress=192.168.1.249:35230
body: <p>I am trying to deploy hyperledger fabric(v1.4.3) solo mode on multi-machines, the role-ip map is as following:</p>
  
  <pre><code>orderer          192.168.1.251
  peer0.org1       192.168.1.249
  peer0.org2       192.168.1.248
  peer1.org1       192.168.1.247
  peer1.org2       192.168.1.246
  </code></pre>
  
  <p>I copy the <code>fabric-samples/first-network</code> into <code>first</code>, and delete some files, the <code>first</code> folder contains:</p>
  
  <pre><code>├── base
  │   ├── docker-compose-base.yaml
  │   └── peer-base.yaml
  ├── channel-artifacts
  ├── configtx.yaml
  ├── crypto-config.yaml
  ├── docker-compose-cli.yaml
      byfn.sh
  </code></pre>
  
  <p>I keep the <code>crypto-config.yaml</code> and <code>configtx.yaml</code> the same as the <code>fabric-samples</code> gives and just change the <code>docker-compose-cli.yaml</code>. </p>
  
  <p>The <code>orderer</code>'s <code>docker-compose-cli.yaml</code>:</p>
  
  <pre><code># Copyright IBM Corp. All Rights Reserved.
  #
  # SPDX-License-Identifier: Apache-2.0
  #
  
  version: '2'
  
  volumes:
    orderer.example.com:
  
  networks:
    byfn:
  
  services:
  
    orderer.example.com:
      extends:
        file:   base/docker-compose-base.yaml
        service: orderer.example.com
      container_name: orderer.example.com
      networks:
        - byfn
  </code></pre>
  
  <p>the <code>peer0.org1</code>'s <code>docker-compose-cli.yaml</code>:</p>
  
  <pre><code># Copyright IBM Corp. All Rights Reserved.
  #
  # SPDX-License-Identifier: Apache-2.0
  #
  
  version: '2'
  
  volumes:
    peer0.org1.example.com:
  
  networks:
    byfn:
  
  services:
  
    peer0.org1.example.com:
      container_name: peer0.org1.example.com
      extends:
        file:  base/docker-compose-base.yaml
        service: peer0.org1.example.com
      networks:
        - byfn
      extra_hosts:
        - "orderer.example.com:192.168.1.251"
        - "peer1.org1.example.com:192.168.1.247"
        - "peer0.org2.example.com:192.168.1.248"
        - "peer1.org2.example.com:192.168.1.246"
  
    cli:
      container_name: cli
      image: hyperledger/fabric-tools:$IMAGE_TAG
      tty: true
      stdin_open: true
      environment:
        - SYS_CHANNEL=$SYS_CHANNEL
        - GOPATH=/opt/gopath
        - CORE_VM_ENDPOINT=unix:///host/var/run/docker.sock
        - FABRIC_LOGGING_SPEC=DEBUG
        #- FABRIC_LOGGING_SPEC=INFO
        - CORE_PEER_ID=cli
        - CORE_PEER_ADDRESS=peer0.org1.example.com:7051             # change in different peer
        - CORE_PEER_LOCALMSPID=Org1MSP                              # change in different peer
        - CORE_PEER_TLS_ENABLED=true
        - CORE_PEER_TLS_CERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.crt      # change in different peer and org
        - CORE_PEER_TLS_KEY_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/server.key       # change in different peer and org
        - CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls/ca.crt      # change in different peer and org
        - CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp      # change in different org
      working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
      command: /bin/bash
      volumes:
          - /var/run/:/host/var/run/
          - ./../chaincode/:/opt/gopath/src/github.com/chaincode
          - ./crypto-config:/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/
          - ./scripts:/opt/gopath/src/github.com/hyperledger/fabric/peer/scripts/
          - ./channel-artifacts:/opt/gopath/src/github.com/hyperledger/fabric/peer/channel-artifacts
      depends_on:
        - peer0.org1.example.com
      networks:
        - byfn
      extra_hosts:
        - "orderer.example.com:192.168.1.251"
        - "peer0.org1.example.com:192.168.1.249"
        - "peer1.org1.example.com:192.168.1.247"
        - "peer0.org2.example.com:192.168.1.248"
        - "peer1.org2.example.com:192.168.1.246"
  </code></pre>
  
  <p>the other peer changes as the comment in above yaml file.  I use the <code>./byfn.sh generate</code> to generate the channel-artifacts on each peer and orderer, and then in peer0.org1（192.168.1.249）cli container, I install the chaincode successfully but when i instantiated the chaincode i see the orderer console throw the error:</p>
  
  <pre><code>[core.comm] ServerHandshake -&gt; ERRO 009 TLS handshake failed with error remote error: tls: bad certificate server=Orderer remoteaddress=192.168.1.249:58812
  </code></pre>
  
  <p>and i notice the error also happens between the peers, i have tried several ways from the internet but all failed. Can anyone help me with it？ Any tutorial to deploy hyperledger fabric in kafka mode is also welcome!</p>
  
  <p>Best Regards!</p>