ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2024-12-19 13:08:04 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
88782f7544
corda/docs/source/compatibility-zones.rst
Mike Hearn 8af404427f Address review comments
2018-10-18 15:13:55 +01:00

3.6 KiB
Raw Blame History

Compatibility zones

Every Corda node is part of a "zone" (also sometimes called a Corda network) that is permissioned. Production deployments require a secure certificate authority. Most users will join an existing network such as Corda Network (the main network) or the Corda Testnet. We use the term "zone" to refer to a set of technically compatible nodes reachable over a TCP/IP network like the internet. The word "network" is used in Corda but can be ambiguous with the concept of a "business network", which is usually more like a membership list or subset of nodes in a zone that have agreed to trade with each other.

To connect to a compatibility zone you need to register with its certificate signing authority (doorman) by submitting a certificate signing request (CSR) to obtain a valid identity for the zone. You could do this out of band, for instance via email or a web form, but there's also a simple request/response protocol built into Corda.

Before you can register, you must first have received the trust store file containing the root certificate from the zone operator. For high security zones this might be delivered physically. Then run the following command:

java -jar corda.jar --initial-registration --network-root-truststore-password <trust store password>

By default it will expect the trust store file to be in the location certificates/network-root-truststore.jks. This can be overridden with the additional --network-root-truststore flag.

The certificate signing request will be created based on node information obtained from the node configuration. The following information from the node configuration file is needed to generate the request.

  • myLegalName Your company's legal name as an X.500 string. X.500 allows differentiation between entities with the same name, as the legal name needs to be unique on the network. If another node has already been permissioned with this name then the permissioning server will automatically reject the request. The request will also be rejected if it violates legal name rules, see node_naming for more information. You can use the X.500 schema to disambiguate entities that have the same or similar brand names.
  • emailAddress e.g. "admin@company.com"
  • devMode must be set to false
  • networkServices or compatibilityZoneURL The Corda compatibility zone services must be configured. This must be either:
    • compatibilityZoneURL The Corda compatibility zone network management service root URL.
    • networkServices Replaces the compatibilityZoneURL when the doorman and network map services are configured to operate on different URL endpoints. The doorman entry is used for registration.

A new pair of private and public keys generated by the Corda node will be used to create the request.

The utility will submit the request to the doorman server and poll for a result periodically to retrieve the certificates. Once the request has been approved and the certificates downloaded from the server, the node will create the keystore and trust store using the certificates and the generated private key.

Note

You can exit the utility at any time if the approval process is taking longer than expected. The request process will resume on restart as long as the --initial-registration flag is specified.

This process only is needed when the node connects to the network for the first time, or when the certificate expires.