Error in orderer2 step_1

[szvarhegyi]

Hy,

First of all, this is very good guide! Thanks a lot!
I try to make this based on your repository, but when i try to fetch config to update orderer2 certificate, i can't fetch it.
I got an TLS handsake error.

root@hlf-workstation:~/FabricNetwork-2.x/artifacts/channel/create-certificate-with-ca/rotate-certs/step_1/orderer2$ ./add_tls_o2_sys_channel.sh 
2022-03-02 23:37:56.447 UTC 0001 ERRO [comm.tls] ClientHandshake -> Client TLS handshake failed after 1.570332ms with error: x509: certificate has expired or is not yet valid: current time 2022-01-28T15:37:56Z is before 2022-03-02T22:47:00Z remoteaddress=127.0.0.1:7050
2022-03-02 23:37:57.451 UTC 0002 ERRO [comm.tls] ClientHandshake -> Client TLS handshake failed after 1.509486ms with error: x509: certificate has expired or is not yet valid: current time 2022-01-28T15:37:57Z is before 2022-03-02T22:47:00Z remoteaddress=127.0.0.1:7050
2022-03-02 23:37:59.054 UTC 0003 ERRO [comm.tls] ClientHandshake -> Client TLS handshake failed after 1.11307ms with error: x509: certificate has expired or is not yet valid: current time 2022-01-28T15:37:59Z is before 2022-03-02T22:47:00Z remoteaddress=127.0.0.1:7050
Error: failed to create deliver client for orderer: orderer client failed to connect to localhost:7050: failed to create new connection: context deadline exceeded
## Encode Orderer2
....
----------------------------
root@hlf-workstation:~/FabricNetwork-2.x/artifacts/channel/create-certificate-with-ca/rotate-certs/step_1/orderer2$ date
Wed Mar  2 23:38:00 UTC 2022

The steps what i did:

• turn off the ntp and set the date to 2022.01.05
• create ca's
• change configurations (720h)
• Create Network participant certificates using CA
• Create Channel Artifacts
• Run all peer services(Persist data for each service)
• Create Channel & Deploy Chaincode
• Start API Server & invoke tx

Everythings is good, and then:

• turn on the ntp
• wait for the time sync
• edit docker-compose for env variables (ORDERER_GENERAL_TLS_TLSHANDSHAKETIMESHIFT, ORDERER_GENERAL_CLUSTER_TLSHANDSHAKETIMESHIFT, ORDERER_GENERAL_AUTHENTICATION_NOEXPIRATIONCHECKS)
• restart orderers
• remove old msp directories from orderers and peers
• copy new msp directories from new-certs to crypto-config (yes only the msp directories)
• restart services
• i can update the first orderer with the new tls certificate and can commit to sys-channel
• i can update the application channel with first orderer certificate

All the changes what i do in your config is change 200h to 800h because this is an older date.