Is that a good idea to replace fabrci-ca by step-ca in hyperledger blockchain network?

[sammi]

I'm evaluating which stack should I choose to implement internal CA in hyperledger fabric blockchain network:

• openssl, it is powerful, but it seems many extra scripts are needed to make it work.
• fabric-ca, it is nice to have some custom features for blockchain peers;
• step-ca, focus on CA and with ACME support, it seems easy to use, and being friendly for k8s.

One thing I'm missing is that I could not find any blockchain use cases by using step-ca, especially being used by hyperledger fabric. Do you guys have anything related to it? Or do you think it is valid use case to apply step-ca in permissioned blockchain network?

[mmalone]

Hi @sammi,

Obviously we're biased, but step-ca & step were designed to be a flexible, easy to use PKI toolchain that should support a lot of different use cases. Permissioned blockchain is certainly one of them. Unfortunately, I don't think anyone on our team has much hyperledger experience, so I can't say much more than that.

We do appreciate the feedback and we have made a note that a tutorial on permissioned blockchain in general / hyperledger specifically would be helpful. If anyone comes across this issue and would like to see this use case documented (or has any notes / advice to share) please give this issue a +1 and/or leave a comment!

If you move forward with using step-ca and have any specific questions about configuring your authority to work with hyperledger we'd be happy to help, and we can use this thread to discuss.

[sammi]

Thanks @mmalone.

I'm still evaluating step-ca in hyperledger fabric network. I'm comparing fabric-ca features and step-ca features by reading the document.

And I have started to build step-ca as Kubernetes node inside my local cluster, then building order and peers organization, each organization will have its own sub ca.

I'd very happy to write a HOW-TO-STEP-CA-IN-HYPERLEDGER-FABRIC document for my step-ca journey.