自10.25在会议中提出“把区块链作为核心技术自主创新重要突破口”后，“区块链”逐渐走进了大众视野，成为金融资本、实体经济和社会舆论共同关注的焦点。

近期国家已对区块链行业加大监管力度，打击虚拟货币炒作，交易，大力发展可控的联盟链。

虽然现在互联网非常发达，但是两个企业之间对接信息仍面临一些问题，例如确认企业信息的真实性，传统确认的过程需要大量的成本，而联盟链的存在却能有效解决这类问题。在PDX坚持不懈的努力下，我们已开发出能用，可用，好用的联盟链。

PDX联盟链的特点

1.数据不会默认公开

不同于公有链，联盟链的数据只限于联盟里的机构及其用户才有权限进行访问。

2.交易速度很快

跟私有链一样，联盟链本质上还是私有链，因此由于其节点不多的原因，达成共识容易，交易速度自然也就快很多。

PDX联盟链说明文档

启动联盟链之后，如果有新的代理加入，需要配置相应的证书证书，则可以连接相应的联盟链。
联盟链可以设置相应的用户权限，控制部署合约和普通交易是否执行。

配置标志

在启动pdxc时，添加--consortium标签。

./utopia --consortium

配置文件：

在/ utopia / chain / [chainId] / data / consortium /文件夹下配置consortium.conf，例如：

{ "name" : "pdx-ecosys", "orgs" : [ { "name" : "abc", "node_ca" : ["node-ca-abc.crt"], "user_ca" : ["user-ca-abc.crt"] }, { "name" : "lmn", "node_ca" : ["node-ca-lmn.crt"], "user_ca" : ["user-ca-lmn.crt"] }, { "name" : "xyz", "node_ca" : ["node-ca-xyz.crt"], "user_ca" : ["user-ca-xyz.crt"] } ], "dapp_auth":true, "user_auth":false}

配置文件说明：

dapp_authuser_auth部署TX常规TX真正真正dü假真正üü真正假d--假假----

d（dapp）：表示部署固体或链码合约时，jwt令牌中的角色r必须是d
u（用户）：表示部署固体或链码合约时，jwt令牌中的角色r至少是u-
表示不需要验证jwt令牌

jwt令牌参数：

token := jwt.NewWithClaims(jwt.SigningMethodES256, jwt.MapClaims{  "ak": "0390d5d104823304eb44276545ce4b3bbedba28171628a1262b0ff0b58b59e3d2f",//auth pubKey  "sk": "02595d553697305c7670dfd92628e5ff68080335265edf804aea4e6e8df5112464",//sender pubKey  "r": "d",//d:dapp-user, u:end-user  "l": 5,//limit  "s": 12345,//sequence  "n": "jru234m5im23i23m4mju2356msddfk4r",//nonce })

说明：ak-签名者的公钥，sk-发送者的公钥，r-用户角色，l-多少个normal block后令牌无效，s-序列号，n-随机字符串。

jwt令牌位置

发送交易时设置jwt：
meta["jwt"]="eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJhayI6IjAzOTBkNWQxMDQ4MjMzMDRlYjQ0Mjc2NTQ1Y2U0YjNiYmVkYmEyODE3MTYyOGExMjYyYjBmZjBiNThiNTllM2QyZiIsImwiOjUwMDAwMCwibiI6MSwiciI6ImQiLCJzIjo1NTU1LCJzayI6IjAyNTk1ZDU1MzY5NzMwNWM3NjcwZGZkOTI2MjhlNWZmNjgwODAzMzUyNjVlZGY4MDRhZWE0ZTZlOGRmNTExMjQ2NCJ9.agZbI5oK4OqJbkZoTslXjm8L-HB7kZ_NB2DRwZf3-r9I6QAGFV0ci2Og9pUpjjjryf4_jbrztwuhQNgIT5cxDA"

总统证书位置

由上级CA提交给上游的证书放在/ utopia / chain / [chainId] / data / consortium /目录下，必须命名为localhost.crt

证书文件生成

orgs中node_ca证书生成，可以通过如下命令：

首先初始化：

#/bin/bash# Init CA Filesmkdir -p ./demoCA/{private,newcerts}touch ./demoCA/index.txtecho 01 > ./demoCA/serial

openssl配置文件openssl.cnf：

## OpenSSL example configuration file.# This is mostly being used for generation of certificate requests.## This definition stops the following lines choking if HOME isn't# defined.HOME   = .RANDFILE  = $ENV::HOME/.rnd# Extra OBJECT IDENTIFIER info:#oid_file  = $ENV::HOME/.oidoid_section  = new_oids# To use this configuration file with the "-extfile" option of the# "openssl x509" utility, name here the section containing the# X.509v3 extensions to use:# extensions  =# (Alternatively, use a configuration file that has only# X.509v3 extensions in its main [= default] section.)[ new_oids ]# We can add new OIDs in here for use by 'ca', 'req' and 'ts'.# Add a simple OID like this:# testoid1=1.2.3.4# Or use config file substitution like this:# testoid2=${testoid1}.5.6# Policies used by the TSA examples.tsa_policy1 = 1.2.3.4.1tsa_policy2 = 1.2.3.4.5.6tsa_policy3 = 1.2.3.4.5.7####################################################################[ ca ]default_ca = CA_default  # The default ca section####################################################################[ CA_default ]dir  = ./demoCA  # Where everything is keptcerts  = $dir/certs  # Where the issued certs are keptcrl_dir  = $dir/crl  # Where the issued crl are keptdatabase = $dir/index.txt # database index file.#unique_subject = no   # Set to 'no' to allow creation of     # several ctificates with same subject.new_certs_dir = $dir/newcerts  # default place for new certs.certificate = $dir/cacert.pem  # The CA certificateserial  = $dir/serial   # The current serial numbercrlnumber = $dir/crlnumber # the current crl number     # must be commented out to leave a V1 CRLcrl  = $dir/crl.pem   # The current CRLprivate_key = $dir/private/cakey.pem# The private keyRANDFILE = $dir/private/.rand # private random number filex509_extensions = usr_cert  # The extentions to add to the cert# Comment out the following two lines for the "traditional"# (and highly broken) format.name_opt  = ca_default  # Subject Name optionscert_opt  = ca_default  # Certificate field options# Extension copying option: use with caution.# copy_extensions = copy# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs# so this is commented out by default to leave a V1 CRL.# crlnumber must also be commented out to leave a V1 CRL.# crl_extensions = crl_extdefault_days = 365   # how long to certify fordefault_crl_days= 30   # how long before next CRLdefault_md = default  # use public key default MDpreserve = no   # keep passed DN ordering# A few difference way of specifying how similar the request should look# For type CA, the listed attributes must be the same, and the optional# and supplied fields are just that :-)policy  = policy_match# For the CA policy[ policy_match ]countryName  = optionalstateOrProvinceName = optionalorganizationName = optionalorganizationalUnitName = optionalcommonName  = optionalemailAddress  = optional# For the 'anything' policy# At this point in time, you must list all acceptable 'object'# types.[ policy_anything ]countryName  = optionalstateOrProvinceName = optionallocalityName  = optionalorganizationName = optionalorganizationalUnitName = optionalcommonName  = suppliedemailAddress  = optional####################################################################[ req ]default_bits  = 2048default_keyfile  = privkey.pemdistinguished_name = req_distinguished_nameattributes  = req_attributesx509_extensions = v3_ca # The extentions to add to the self signed cert# Passwords for private keys if not present they will be prompted for# input_password = secret# output_password = secret# This sets a mask for permitted string types. There are several options.# default: PrintableString, T61String, BMPString.# pkix  : PrintableString, BMPString (PKIX recommendation before 2004)# utf8only: only UTF8Strings (PKIX recommendation after 2004).# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).# MASK:XXXX a literal mask value.# WARNING: ancient versions of Netscape crash on BMPStrings or UTF8Strings.string_mask = utf8only# req_extensions = v3_req # The extensions to add to a certificate request[ req_distinguished_name ]countryName   = Country Name (2 letter code)countryName_default  = AUcountryName_min   = 2countryName_max   = 2stateOrProvinceName  = State or Province Name (full name)stateOrProvinceName_default = Some-StatelocalityName   = Locality Name (eg, city)0.organizationName  = Organization Name (eg, company)0.organizationName_default = Internet Widgits Pty Ltd# we can do this but it is not needed normally :-)#1.organizationName  = Second Organization Name (eg, company)#1.organizationName_default = World Wide Web Pty LtdorganizationalUnitName  = Organizational Unit Name (eg, section)#organizationalUnitName_default =commonName   = Common Name (e.g. server FQDN or YOUR name)commonName_max   = 64emailAddress   = Email AddressemailAddress_max  = 64# SET-ex3   = SET extension number 3[ req_attributes ]challengePassword  = A challenge passwordchallengePassword_min  = 4challengePassword_max  = 20unstructuredName  = An optional company name[ usr_cert ]# These extensions are added when 'ca' signs a request.# This goes against PKIX guidelines but some CAs do it and some software# requires this to avoid interpreting an end user certificate as a CA.basicConstraints=CA:TRUE# Here are some examples of the usage of nsCertType. If it is omitted# the certificate can be used for anything *except* object signing.# This is OK for an SSL server.# nsCertType   = server# For an object signing certificate this would be used.# nsCertType = objsign# For normal client use this is typical# nsCertType = client, email# and for everything including object signing:# nsCertType = client, email, objsign# This is typical in keyUsage for a client certificate.# keyUsage = nonRepudiation, digitalSignature, keyEncipherment# This will be displayed in Netscape's comment listbox.nsComment   = "OpenSSL Generated Certificate"# PKIX recommendations harmless if included in all certificates.subjectKeyIdentifier=hashauthorityKeyIdentifier=keyid,issuer# This stuff is for subjectAltName and issuerAltname.# Import the email address.# subjectAltName=email:copy# An alternative to produce certificates that aren't# deprecated according to PKIX.# subjectAltName=email:move# Copy subject details# issuerAltName=issuer:copy#nsCaRevocationUrl  = http://www.domain.dom/ca-crl.pem#nsBaseUrl#nsRevocationUrl#nsRenewalUrl#nsCaPolicyUrl#nsSslServerName# This is required for TSA certificates.# extendedKeyUsage = critical,timeStamping[ v3_req ]# Extensions to add to a certificate requestbasicConstraints = CA:FALSEkeyUsage = nonRepudiation, digitalSignature, keyEncipherment[ v3_ca ]# Extensions for a typical CA# PKIX recommendation.subjectKeyIdentifier=hashauthorityKeyIdentifier=keyid:always,issuer# This is what PKIX recommends but some broken software chokes on critical# extensions.#basicConstraints = critical,CA:true# So we do this instead.basicConstraints = CA:true# Key usage: this is typical for a CA certificate. However since it will# prevent it being used as an test self-signed certificate it is best# left out by default.# keyUsage = cRLSign, keyCertSign# Some might want this also# nsCertType = sslCA, emailCA# Include email address in subject alt name: another PKIX recommendation# subjectAltName=email:copy# Copy issuer details# issuerAltName=issuer:copy# DER hex encoding of an extension: beware experts only!# obj=DER:02:03# Where 'obj' is a standard or added object# You can even override a supported extension:# basicConstraints= critical, DER:30:03:01:01:FF[ crl_ext ]# CRL extensions.# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.# issuerAltName=issuer:copyauthorityKeyIdentifier=keyid:always[ proxy_cert_ext ]# These extensions should be added when creating a proxy certificate# This goes against PKIX guidelines but some CAs do it and some software# requires this to avoid interpreting an end user certificate as a CA.basicConstraints=CA:FALSE# Here are some examples of the usage of nsCertType. If it is omitted# the certificate can be used for anything *except* object signing.# This is OK for an SSL server.# nsCertType   = server# For an object signing certificate this would be used.# nsCertType = objsign# For normal client use this is typical# nsCertType = client, email# and for everything including object signing:# nsCertType = client, email, objsign# This is typical in keyUsage for a client certificate.# keyUsage = nonRepudiation, digitalSignature, keyEncipherment# This will be displayed in Netscape's comment listbox.nsComment   = "OpenSSL Generated Certificate"# PKIX recommendations harmless if included in all certificates.subjectKeyIdentifier=hashauthorityKeyIdentifier=keyid,issuer# This stuff is for subjectAltName and issuerAltname.# Import the email address.# subjectAltName=email:copy# An alternative to produce certificates that aren't# deprecated according to PKIX.# subjectAltName=email:move# Copy subject details# issuerAltName=issuer:copy#nsCaRevocationUrl  = http://www.domain.dom/ca-crl.pem#nsBaseUrl#nsRevocationUrl#nsRenewalUrl#nsCaPolicyUrl#nsSslServerName# This really needs to be in place for it to be a proxy certificate.proxyCertInfo=critical,language:id-ppl-anyLanguage,pathlen:3,policy:foo####################################################################[ tsa ]default_tsa = tsa_config1 # the default TSA section[ tsa_config1 ]# These are used by the TSA reply generation only.dir  = ./demoCA  # TSA root directoryserial  = $dir/tsaserial # The current serial number (mandatory)crypto_device = builtin  # OpenSSL engine to use for signingsigner_cert = $dir/tsacert.pem  # The TSA signing certificate     # (optional)certs  = $dir/cacert.pem # Certificate chain to include in reply     # (optional)signer_key = $dir/private/tsakey.pem # The TSA private key (optional)default_policy = tsa_policy1  # Policy if request did not specify it     # (optional)other_policies = tsa_policy2, tsa_policy3 # acceptable policies (optional)digests  = md5, sha1  # Acceptable message digests (mandatory)accuracy = secs:1, millisecs:500, microsecs:100 # (optional)clock_precision_digits = 0 # number of digits after dot. (optional)ordering  = yes # Is ordering defined for timestamps?    # (optional, default: no)tsa_name  = yes # Must the TSA name be included in the reply?    # (optional, default: no)ess_cert_id_chain = no # Must the ESS cert id chain be included?    # (optional, default: no)

配置环境变量，覆盖openssl的替换配置文件：

export OPENSSL_CONF=[your path]/openssl.cnf

node-ca-abc.crt证书生成命令：

cat root.crt intermediate.crt > node-ca-abc.crt

其中root.crt生成命令：

#/bin/bash# Create Root-CA Certifacate Keypairopenssl ecparam -genkey -name secp256k1 -out ./demoCA/private/cakey.pem# Create Root-CA Certifacate Requestopenssl req -new -days 365 -key ./demoCA/private/cakey.pem -out root.csr -subj "/C=CN/ST=Beijing/L=Haidian/O=PDX/OU=PDX/CN=CA-Root"# Create Root-CA Certifacate By Sign Requestopenssl ca -selfsign -in root.csr -out root.crt

其中intermediate.crt生成命令：

#/bin/bash# Create intermediate-CA Certifacate Keypairopenssl ecparam -genkey -name secp256k1 -out ./demoCA/private/intermediate.key# Create Intermediate-CA Certifacate Requestopenssl req -new -days 365 -key ./demoCA/private/intermediate.key -out intermediate.csr -subj "/C=CN/ST=Beijing/L=Haidian/O=PDX/OU=PDX/CN=CA-intermediate"# Create Intermediate-CA Certifacate By Sign Requestopenssl ca -in intermediate.csr -out intermediate.crt -days 365 -cert root.crt -keyfile ./demoCA/private/cakey.pem

localhost.crt的csr文件由本地上游的私钥签名生成，生成node.csr的方式：

a pre_string : 30740201010420the privkey : (32 bytes as 64 hexits)a mid_string : a00706052b8104000aa144034200 (identifies secp256k1)the pubkey : (65 bytes as 130 hexits)

#/bin/bash# Create Node CA Certifacate Keypairecho 30740201010420 <privkey_32bytes_64hexits> a00706052b8104000aa144034200 <pubkey_65bytes_130hexits> | xxd -r -p | openssl ec -inform d > ./demoCA/private/localhost.key# Create Node CA Certifacate Requestopenssl req -new -days 365 -key ./demoCA/private/localhost.key -out node.csr -subj "/C=CN/ST=Beijing/L=Haidian/O=PDX/OU=PDX/CN=CA-Localhost"

或者通过子命令gencsr生成node.csr在当前目录下：

./utopia gencsr --keystorefile <keystore file> --password <password file>

根据node.csr文件生成localhost.crt命令：

#/bin/bash# Create Node CA Certifacate By Sign Requestopenssl ca -in node.csr -out localhost.crt -days 365 -cert intermediate.crt -keyfile ./demoCA/private/intermediate.key

orgs中user_ca证书生成，可以通过如下命令：

#/bin/bash# Create Root-CA Certifacate Keypairopenssl ecparam -genkey -name secp256k1 -out ./demoCA/private/cakey.pem# Create Root-CA Certifacate Requestopenssl req -new -days 365 -key ./demoCA/private/cakey.pem -out user_root.csr -subj "/C=CN/ST=Beijing/L=Haidian/O=PDX/OU=PDX/CN=CA-Root"# Create Root-CA Certifacate By Sign Requestopenssl ca -selfsign -in user_root.csr -out user_root.crt

PDX联盟链的建立

PDX Unity 支持基于部署描述，一键式创建在安全、性能等指标取舍上可能不兼容的区块链（任意大小的公有链或联盟链），同时满足各自在安全、隐私、吞吐量、延迟、规模、海量数据和信任方面的特别需求。并实现其在 PDX公有链上同时运行、和谐共存，而且具有真正的全链级的可信强度。

链接：PDX Unity 操作指南（点击链接查看如何建链）

区块链近期发展重心在联盟链

联盟链的节点在软硬体和网络I/O的水平相近，共识与交易处理的效率相对均衡。另外，有限节点的利益共生体之间关系更加紧密，对有助于利益最大化的数据透明共享也会更加积极。

因此，联盟链更符合企业级需求，应用更有针对性、效率也更高，同时，联盟链也可以在企业级应用市场最大限度发挥区块链技术去中心化过程数据管理特性，而企业也更有动力采用区块链技术、让“不可篡改”和“可追溯”减少企业内部不同单位或企业间非互信环境下达成交易的“信用税”。