Get x509: certificate error when fabric-ca-client enroll

[cfengliu]

Hi,
We are getting below " x509: certificate is valid for ingress.local" error while trying to enroll ord-admin on rancher 2.0. The error code is below:

admin@hosts:~/hlf/hgf-k8s-workshop/prod_example$ FABRIC_CA_CLIENT_HOME=./config fabric-ca-client enroll -u https://ord-admin:OrdAdm1nPW@$CA_INGRESS -M ./OrdererMSP
2019/07/03 09:54:35 [INFO] TLS Enabled
2019/07/03 09:54:35 [INFO] generating key: &{A:ecdsa S:256}
2019/07/03 09:54:35 [INFO] encoded CSR
Error: POST failure of request: POST https://k8s.blockchain.iii/enroll
{"hosts":["sysadmin-virtual-machine202"],"certificate_request":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBSDCB8AIBADBVMQsw-----END CERTIFICATE REQUEST-----\n"
,"profile":"","crl_override":"","label":"","NotBefore":"0001-01-01T00:00:00Z","NotAfter":"0001-01-01T00:00:00Z","CAName":""}: 
Post https://k8s.blockchain/enroll: x509: certificate is valid for ingress.local, not k8s.blockchain

Is there any suggestion for this error?

[jchai002]

I'm also getting this error. My suspicion is that the SSL for the ingress controller is not set up. Because

curl https://$CA_INGRESS/cainfo fails with this error

`curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
of Certificate Authority (CA) public keys (CA certs). If the default
bundle file isn't adequate, you can specify an alternate file
using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
the bundle, the certificate verification probably failed due to a
problem with the certificate (it might be expired, or the name might
not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
the -k (or --insecure) option.
HTTPS-proxy has similar options --proxy-cacert and --proxy-insecure.`

But I'm not 100% sure this is the issue. Any help on this one would be highly appreciated!