Fabric-ca-server 是否支持代表客户端生成密钥对？
从 Fabric CA 文档中可以清楚地看出，密钥生成发生在客户端（即，fabric-ca-client）端，并且生成的公钥（与 CSR 一起）发送到 CA（即，fabric-ca-server） ）进行认证。
另一种常见的 PKI 使用情况又如何呢？其中客户端仅发送 CSR，并让 CA 生成公钥和私钥，然后将公钥和私钥的证书返回给客户端？
Fabric CA 支持这个用例吗？如果是这样，我可以在哪里找到文档？
From the Fabric CA documentation it is clear that key generation occurs on the client (i.e., fabric-ca-client) side and that the generated public key is sent (together with the CSR) to the CA (i.e., fabric-ca-server) for certification.
What about the other common PKI use case wherein the client just sends a CSR and has the CA generate both public and private keys returning the certificate of the public key and the private key back to the client?
Does Fabric CA support this use case? If so, where might I find documentation?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
Fabric CA 看起来并不支持这个用例，这可以解释为什么它不在文档中。然而，Fabric 不依赖 Fabric CA 来创建其证书。您可以使用自己的流程来生成密钥和证书，只要密钥是 Fabric 支持的类型（ECDSA）即可。
It doesn't look like Fabric CA supports this use case which would explain why it's not in the documentation. However Fabric is not reliant on Fabric CA to create it's certificates. You can use your own process to generate your keys and certificates so long as the keys are of the type supported by Fabric which is ECDSA.
因此，经过更多研究后，我得出以下结论（请注意 david_k 的评论，即您根本不必使用 Fabric CA Server）：
看起来，基于阅读，客户端生成的密钥有明显的偏好当前文档第 3.4.1 节（截至 2022 年 3 月 24 日）。
这就留下了密钥管理策略的问题，该策略似乎遵循 NIST 800-57，取自 https://henry-fabric.readthedocs.io/en/latest/Setup/ca-setup.html 即，
我猜测 Fabric-ca-server 正在强制执行此策略。
So after a little more research I've come to the following conclusion (pls note david_k's comment that you are not compelled to use Fabric CA Server at all):
It would appear that there is a clear preference for client generated keys based on a reading of section 3.4.1 of the current documentation (as per 24.03.2022).
This leaves the question of key management policy which seems to be following NIST 800-57 here taken from the documentation on https://henry-fabric.readthedocs.io/en/latest/Setup/ca-setup.html i.e,
I am guessing that the fabric-ca-server is enforcing this policy.