CBDH Identity & Certificate Management 2 — Questions and Answers
Question 1: Which tool is commonly used to generate cryptographic material (certificates and keys) for a Hyperledger Fabric network?
- cryptogen (Correct answer)
- keytool
- openssl-fabric
- fabric-keygen
Correct answer: cryptogen
The `cryptogen` tool is the standard Fabric utility for generating all required cryptographic material based on a network topology defined in a crypto-config.yaml file.
Question 2: What is the key difference between a local MSP and a channel MSP in Hyperledger Fabric?
- Local MSP defines identity at the node level, while channel MSP defines membership rules for a specific channel (Correct answer)
- Local MSP is for ordering nodes only, while channel MSP is for endorsement peers only
- Local MSP handles TLS certificates, while channel MSP handles enrollment certificates
- There is no difference; they reference the same configuration
Correct answer: Local MSP defines identity at the node level, while channel MSP defines membership rules for a specific channel
A local MSP defines the identity and permissions of a specific node or user, while a channel MSP defines the rules for validating identities that can participate in a given channel.
Question 3: What does CRL stand for in Hyperledger Fabric identity management?
- Certificate Rotation List
- Certificate Revocation List (Correct answer)
- Channel Registration Log
- Cryptographic Reference Library
Correct answer: Certificate Revocation List
CRL stands for Certificate Revocation List, which identifies certificates that have been revoked and should no longer be trusted within the Fabric network.
Question 4: What is the purpose of the `signcerts` folder within an MSP directory structure?
- To store the organization's CA root certificates
- To store the entity's own signing certificate used for identity (Correct answer)
- To store TLS certificates for secure communication
- To store admin certificates for the organization
Correct answer: To store the entity's own signing certificate used for identity
The `signcerts` folder in an MSP directory contains the entity's own X.509 certificate used for signing transactions and proposals.
Question 5: What is the role of the `admincerts` folder in a Hyperledger Fabric MSP?
- It stores certificates of other organizations' administrators
- It contains certificates of identities with administrative privileges for the organization (Correct answer)
- It stores the orderer's admin certificate exclusively
- It holds the CA signing certificate for verification
Correct answer: It contains certificates of identities with administrative privileges for the organization
The `admincerts` folder contains certificates of identities granted administrative privileges, allowing them to perform admin operations like instantiating chaincode on channels.
Question 6: Why must an identity be registered before it can be enrolled in Hyperledger Fabric CA?
- Registration initializes the peer node's ledger state
- Registration creates a record of the identity in the CA database before credentials can be issued (Correct answer)
- Registration submits a transaction to the ordering service
- Registration installs the required chaincode on the peer
Correct answer: Registration creates a record of the identity in the CA database before credentials can be issued
Registration creates an entry in the CA's database with the identity's attributes and secret, which is required before the identity can enroll to receive its X.509 certificates.
Question 7: What is an affiliation in Hyperledger Fabric CA?
- A peer grouping used for gossip communication optimization
- An organizational hierarchy used to associate identities with specific departments or groups (Correct answer)
- A channel configuration parameter for member policies
- A smart contract deployment scope restricting execution
Correct answer: An organizational hierarchy used to associate identities with specific departments or groups
Affiliations in Fabric CA represent organizational hierarchies (e.g., org1.department1) and are used to associate identities with specific parts of an organization when registering.
CBDH Identity & Certificate Management 2
Which tool is commonly used to generate cryptographic material (certificates and keys) for a Hyperledger Fabric network?