title: How to configure mutual TLS in Hyperledger Fabric?
body: <p>In Hyperledger network I have enabled both TLS and CLIENTAUTH (on peers and orderers, not on CA). But when it comes to submitting transactions via fabric-sdk-node libraries I keep getting errors during verification of client's certificates.</p>
  
  <p>I also tried setting TLS client certificates explicitly but no luck.
  <a href="https://fabric-sdk-node.github.io/tutorial-mutual-tls.html" rel="nofollow noreferrer">https://fabric-sdk-node.github.io/tutorial-mutual-tls.html</a></p>
  
  <p>peer / order .yaml</p>
  
  <pre><code>- name: CORE_PEER_TLS_ENABLED
    value: "true"
  - name: CORE_PEER_TLS_CERT_FILE
    value: /shared/crypto-config/peerOrganizations/org1.example.com/peers/blockchain-org1peer2.org1.example.com/tls/server.crt
  - name: CORE_PEER_TLS_KEY_FILE
    value: /shared/crypto-config/peerOrganizations/org1.example.com/peers/blockchain-org1peer2.org1.example.com/tls/server.key
  - name: CORE_PEER_TLS_ROOTCERT_FILE
    value: /shared/crypto-config/peerOrganizations/org1.example.com/peers/blockchain-org1peer2.org1.example.com/tls/ca.crt
  - name: CORE_PEER_TLS_CLIENTAUTHREQUIRED
    value: "true"
  - name: CORE_PEER_TLS_CLIENTROOTCAS_FILES
    value: /shared/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/ca.crt
  - name: CORE_PEER_TLS_CLIENTCERT_FILE
    value: /shared/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.crt
  - name: CORE_PEER_TLS_CLIENTKEY_FILE
    value: /shared/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.key
  </code></pre>
  
  <p>connection.json</p>
  
  <pre><code>{
      "name": "bam-ticketing-network",
      "version": "1.0.0",
      "client": {
          "organization": "Org1",
          "connection": {
              "timeout": {
                  "peer": {
                      "endorser": "300"
                  },
                  "orderer": "300"
              }
          },
          "credentialStore": {
            "path": "./local_fabric/tmp/hfc-kvs",
            "cryptoStore": {
              "path": "./local_fabric/tmp/hfc-cvs"
            },
            "wallet": "wallet"
          },
          "tlsCerts": {
              "systemCertPool": true,
              "client": {
                  "key": {
                      "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.key"
                  },
                  "cert": {
                      "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.crt"
                  }
              }
          }
      },
      "channels": {
          "channel1": {
              "orderers": [
                  "blockchain-orderer1",
                  "blockchain-orderer2",
                  "blockchain-orderer3"
              ],
              "peers": {
                  "blockchain-org1peer1": {
                      "endorsingPeer": true,
                      "chaincodeQuery": true,
                      "ledgerQuery": true,
                      "eventSource": true
                  },
                  "blockchain-org1peer2": {
                      "endorsingPeer": true,
                      "chaincodeQuery": true,
                      "ledgerQuery": true,
                      "eventSource": true
                  }
              }
          }
      },
      "organizations": {
          "Org1": {
              "mspid": "Org1MSP",
              "peers": [
                  "blockchain-org1peer1",
                  "blockchain-org1peer2"
              ],
              "certificateAuthorities": [
                  "blockchain-ca"
              ],
              "adminPrivateKey": [
                  "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp/keystore/key.pem"
              ],
              "signedCert": [
                  "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/msp/signcerts/Admin@org1.example.com-cert.pem"
              ]
          }
      },
      "orderers": {
          "blockchain-orderer1": {
              "url": "grpcs://192.168.99.130:31011",
              "grpcOptions": {
                  "ssl-target-name-override": "blockchain-orderer1",
                  "grpc-max-send-message-length": 4194304
              },
              "tlsCACerts": {
                  "path": "./local_fabric/certs/crypto-config/ordererOrganizations/example.com/orderers/blockchain-orderer1.example.com/tls/ca.crt"
              }
          },
          "blockchain-orderer2": {
              "url": "grpcs://192.168.99.130:31012",
              "grpcOptions": {
                  "ssl-target-name-override": "blockchain-orderer2",
                  "grpc-max-send-message-length": 4194304
              },
              "tlsCACerts": {
                  "path": "./local_fabric/certs/crypto-config/ordererOrganizations/example.com/orderers/blockchain-orderer2.example.com/tls/ca.crt"
              }
          },
          "blockchain-orderer3": {
              "url": "grpcs://192.168.99.130:31013",
              "grpcOptions": {
                  "ssl-target-name-override": "blockchain-orderer3",
                  "grpc-max-send-message-length": 4194304
              },
              "tlsCACerts": {
                  "path": "./local_fabric/certs/crypto-config/ordererOrganizations/example.com/orderers/blockchain-orderer3.example.com/tls/ca.crt"
              }
          }
      },
      "peers": {
          "blockchain-org1peer1": {
              "url": "grpcs://192.168.99.130:30110",
              "grpcOptions": {
                  "ssl-target-name-override": "blockchain-org1peer1",
                  "grpc.keepalive_time_ms": 600000
              },
              "clientKey": { 
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.key"
              },
              "clientCert": {
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.crt"
              },
              "tlsCACerts": {
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/peers/blockchain-org1peer1.org1.example.com/tls/ca.crt"
              }
          },
          "blockchain-org1peer2": {
              "url": "grpcs://192.168.99.130:30210",
              "grpcOptions": {
                  "ssl-target-name-override": "blockchain-org1peer2",
                  "grpc.keepalive_time_ms": 600000
              },
              "clientKey": { 
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.key"
              },
              "clientCert": {
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.crt"
              },
              "tlsCACerts": {
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/peers/blockchain-org1peer2.org1.example.com/tls/ca.crt"
              }
          }
      },
      "certificateAuthorities": {
          "blockchain-ca": {
              "url": "https://192.168.99.130:30054",
              "registrar": {
                  "enrollmentID": "admin",
                  "enrollmentSecret": "adminpw",
                  "profile": "tls"
              },
              "httpOptions": {
                  "verify": false
              },
              "tlsCACerts": {
                  "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/ca/ca.org1.example.com-cert.pem",
                  "client": {
                      "key": {
                          "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.key"
                      },
                      "cert": {
                          "path": "./local_fabric/certs/crypto-config/peerOrganizations/org1.example.com/users/Admin@org1.example.com/tls/client.crt"
                      }
                  }
              }
          }
      }
  }
  
  </code></pre>
  
  <p>I keep getting this error:</p>
  
  <p>On peer: ERRO 1587b[0m TLS handshake failed with error tls: failed to verify client's certificate: x509: certificate signed by unknown authority server=PeerServer remoteaddress=172.17.0.1:62440</p>
  
  <p>On nodejs app: ERRO 11347[0m TLS handshake failed with error tls: failed to verify client's certificate: x509: certificate signed by unknown authority server=PeerServer remoteaddress=172.17.0.1:6156</p>
  
  <p>I would expect that fabric client or gateway could provide some option to support mutual TLS or some sample of connection.json.</p>