Network Design & Administration Flashcards

What type of certificate does the Fabric CA issue to identify a user or node in transactions?

Answer: Enrollment certificate (ECert)

Fabric CA issues ECerts that identify participants for signing transactions.

In a local MSP directory, which folder holds the node's or user's private signing key?

Answer: keystore

The keystore folder stores the private key matching the signcerts certificate.

What do Node OUs allow an MSP to do?

Answer: Classify identities as client, peer, admin or orderer from certificate OU attributes

Node OUs map the OU in certificates to roles used in policies.

Which setting makes peers require TLS client certificates from connecting clients?

Answer: tls.clientAuthRequired=true

Setting clientAuthRequired enables mutual TLS.

After revoking an identity with Fabric CA, what must be done for the channel to reject it?

Answer: Generate a CRL and update the channel MSP configuration with it

The CRL must be added to the MSP definition through a channel config update.

What is the difference between register and enroll in Fabric CA?

Answer: Register creates an identity and secret; enroll uses that secret to obtain a certificate

An admin registers an identity, then the identity enrolls with its ID and secret to get its key and certificate.

Which standard lets Fabric keep private keys in a hardware security module?

Answer: PKCS#11

Fabric supports HSMs through the PKCS#11 interface in the BCCSP configuration.