Understanding Various Certificates in Hyperledger fabric

Question

Hello I am tryin to use hyperledger fabric for a block chain implementation. I did the first-network demo and found lot of certificates in it. I have tried arranging them hierarchically in below picture.

I Have some questions related to them

1. Why are all these different categories of certs required. Like different msp tls are they generated once and copied at different locations?
2. How these different certificates will be used in different scenarios (like enrollment and communication.)
3. If we dont use cryptogen then can some third party generate all these certificates.
4. How can fabric-ca or any other third party CA help here.

TIA.

Answer 1

First of all thanks for creating the tree for the same.

I am a beginner in the hyperledger but what i understand from the hyperledger document that each Organization requires a unique root certificate (ca-cert), that binds specific components (peers and orderers) to that organization. Transactions and communications within Fabric are signed by an entity's private key (keystore), and then verified by means of a public key (signcerts).

As different organization also required to communicate or share their ledger so there is need of CA or MSP on organization level. Within each organization we can have multiple peers so we need certification for these peers too. Even peers from different organizations can join each other so signcerts(for authenticating) and TLScerts(for a secure handshake).

To have a look how these are generate i suggest you to Manually generate the artifacts

http://hyperledger-fabric.readthedocs.io/en/latest/build_network.html

and see the different certs in the folders inside as you created them.