title: Hyperledger Fabric: Do we need to pass TLS cert/key files while joining channel?
body: <p>I have a multi-org network fabric network up and running from different hosts. </p>
  
  <p>The docker containers for the peers have TLS enabled. The build configuration of the peer:</p>
  
  <pre><code>- CORE_PEER_TLS_ENABLED=true
  - CORE_PEER_TLS_CERT_FILE=/etc/hyperledger/fabric/tls/server.crt
  - CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
  - CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt
  </code></pre>
  
  <p>While creating and joining the channel I followed <a href="https://hyperledger-fabric.readthedocs.io/en/release-1.1/build_network.html#create-join-channel" rel="nofollow noreferrer">byfn docs</a> and did not supply the TLS cert/file of the peer while joining the channel. All the peers were able to join the channel.</p>
  
  <p>However, when I tried to fetch the newest block using <code>peer channel fetch newest -o orderer.example.com:7050 -c examplechannel</code>, I got the error:</p>
  
  <blockquote>
    <p>Serve failed to complete security handshake from "ip:43402": tls: first record does not look like a TLS handshake</p>
  </blockquote>
  
  <p>Further, I referred <a href="https://hyperledger-fabric.readthedocs.io/en/release-1.2/enable_tls.html" rel="nofollow noreferrer">this doc</a> on TLS and <a href="https://hyperledger-fabric.readthedocs.io/en/release-1.2/commands/peerchannel.html#peer-channel-fetch" rel="nofollow noreferrer">this doc</a>
  on passing TLS certs of the peer with the above fetch command:</p>
  
  <pre><code>peer channel fetch newest -o orderer.example.com:7050 -c examplechannel --tls --certfile $CORE_PEER_TLS_CERT_FILE --keyfile $CORE_PEER_TLS_KEY_FILE --cafile $CORE_PEER_TLS_ROOTCERT_FILE
  </code></pre>
  
  <p>This gave a new error:</p>
  
  <blockquote>
    <p>grpc: Server.Serve failed to complete security handshake from "ip:43496": remote error: tls: bad certificate</p>
  </blockquote>
  
  <p><a href="https://hyperledger-fabric.readthedocs.io/en/release-1.2/enable_tls.html#debugging-tls-issues" rel="nofollow noreferrer">Debugging TLS issues</a> doc states that this happens when the server does not trust the client certificate. So in my case, I infer that the orderer is not trusting the certificate that the peer is passing.</p>
  
  <p>So</p>
  
  <ol>
  <li>Does it mean that I was supposed to pass TLS_CERT, TLS_KEY and TLS_ROOT cert while proposing a channel join from this peer?</li>
  <li>If #1 is true, can I pass these certificates without bringing down the network and rejoining the channel with certs?</li>
  <li>While creating the channel, it uses orderer's ca-cert. Also, when submitting anchor peer transaction, it uses orderer's ca cert? So am I supposed to use Orderer's ca cert for peer fetch command as well?</li>
  <li>If #3 is true, then in a production environment, do we need to build up the peer containers such that it contains orderer's ca-cert?</li>
  </ol>