I want 4 intermediate CAs for a peer organization: ICA1, ICA2, ICA3 and ICA4
- one for every Node OU (peer, orderer, admin and client).
Let's say if I place ICA1
as the cacerts
attribute in the Peer Node OU of the channel configuration, then will a peer
identity under a different ICA
(ICA2
, ICA3
or ICA4
), be able to satisfy a policy which says signature of "OrgMSP.peer"
?
OrgMSP.<role>
? I do not wish to create an MSP definition for every department or team in the organization. So, is it achievable without that?"Signature of one-of 'OrgMSP.peer'"
and let's say that here, cacerts
property for the peer
OU will be ICA1 and ICA3. Is this achievable?When you specify the nodeOU configuration, you may simply supply the OU name corresponding to the role (it sounds like this is what you've done), or you may specify the OU name and an issuing certificate. This could be a root CA, or an intermediate CA, but in either case, in order to satisfy that role, the certificate must have both the OU specified and be issued by the specified CA.
Note: Each role/certificate pair informs the MSP of a valid issuer for certificates satisfying a role. So, if you have CA1, CA2, ICA1, and ICA2, you may specify a given role twice, once for CA1 and once for ICA2. Then only certificates (directly) issued by either CA1 or ICA2 may satisfy the role.
If you look in the sample MSP configuration, you can see that certificate may be specified, but is omitted by default.
You can see more details about how this certificate is used in the actual proto documentation.