Joining an existing compatibility zone

To connect to a compatibility zone you need to register with its certificate signing authority (or doorman) by submitting a certificate signing request (CSR) to obtain a valid identity for the zone. This process is only necessary when the node connects to the network for the first time, or when the certificate expires. You could do this out of band, for instance via email or a web form, but there’s also a simple request/response utility built into the node.

Before using this utility, you must first have received the trust store file containing the root certificate from the zone operator. For high security zones, this might be delivered physically. Then run the following command:

java -jar corda.jar --initial-registration --network-root-truststore-password <trust store password>

By default, the utility expects the trust store file to be in the location certificates/network-root-truststore.jks. This can be overridden using the additional --network-root-truststore flag.

The utility performs the following steps:

  • It creates a certificate signing request based on the following information from the node’s configuration file (see Node configuration ):

  • myLegalName Your company’s legal name as an X.500 string. X.500 allows differentiation between entities with the same name, as the legal name needs to be unique on the network. If another node has already been permissioned with this name then the permissioning server will automatically reject the request. The request will also be rejected if it violates legal name rules, see node_naming for more information. You can use the X.500 schema to disambiguate entities that have the same or similar brand names

  • emailAddress e.g. “admin@company.com

  • devMode must be set to false

  • compatibilityZoneURL or networkServices The address(es) used to register with the compatibility zone and retrieve the network map. These should be provided to you by the operator of the zone. This must be either:

    • compatibilityZoneURL The root address of the network management service. Use this if both the doorman and the network map service are operating on the same URL endpoint
    • networkServices The root addresses of the doorman and the network map service. Use this if the doorman and the network map service are operating on the same URL endpoint, where:
      • doormanURL is the root address of the doorman. This is the address used for initial registration
      • networkMapURL is the root address of the network map service
  • It generates a new private/public keypair to sign the certificate signing request

  • It submits the request to the doorman server and polls periodically to retrieve the corresponding certificates

  • It creates the node’s keystore and trust store using the received certificates

  • It creates and stores the node’s TLS keys and legal identity key along with their corresponding certificate-chains

Was this page helpful?

Thanks for your feedback!

Chat with us

Chat with us on our #docs channel on slack. You can also join a lot of other slack channels there and have access to 1-on-1 communication with members of the R3 team and the online community.

Propose documentation improvements directly

Help us to improve the docs by contributing directly. It's simple - just fork this repository and raise a PR of your own - R3's Technical Writers will review it and apply the relevant suggestions.

We're sorry this page wasn't helpful. Let us know how we can make it better!

Chat with us

Chat with us on our #docs channel on slack. You can also join a lot of other slack channels there and have access to 1-on-1 communication with members of the R3 team and the online community.

Create an issue

Create a new GitHub issue in this repository - submit technical feedback, draw attention to a potential documentation bug, or share ideas for improvement and general feedback.

Propose documentation improvements directly

Help us to improve the docs by contributing directly. It's simple - just fork this repository and raise a PR of your own - R3's Technical Writers will review it and apply the relevant suggestions.