title: Setting up TLS communication between orderers and peers
body: <p>I've been putting together a Kubernetes setup for running a production Fabric 1.0.0 network, and the next step of that is adding TLS communication between all network resources.  In order to generate TLS certs, I've set up fabric-ca to run with multiple roots, the first CA being used to generate the MSP signing certs, and the second to generate the TLS artifacts.  I've also configured fabric-ca to generate TLS certs with a different profile, according to <a href="https://gerrit.hyperledger.org/r/#/c/11103/11/cmd/fabric-ca-server/config.go" rel="nofollow noreferrer">this commit</a>.</p>
  
  <p>The TLS certificates have a CN record matching the hostname of each server ("peer-x.peer"), and a number of SANs (but not the IP address of the server, since these are generated before those containers spin up).</p>
  
  <p>TLS communication with fabric-ca-server/client seems to be working fine.  I can create enrollment certificates with both CAs for all of my peers and orderers.</p>
  
  <p>When creating the orderer genesis block with <code>configtxgen</code>, I've taken the cacert from the TLS ca and placed that in the <code>tlscacerts</code> subdirectory of the org's msp directory, so it should be included where necessary.</p>
  
  <p>I've been able to run the <code>peer channel create</code> and <code>peer channel join</code> commands successfully, but after the peers join the channel, I see this appear in the leader peer's log:</p>
  
  <pre><code>[deliveryClient] StartDeliverForChannel -&gt; DEBU 307 This peer will pass blocks from orderer service to other peers for channel lynnhurst
  [ConnProducer] NewConnection -&gt; ERRO 308 Failed connecting to orderer-2.orderer:7050 , error: x509: certificate signed by unknown authority
  [ConnProducer] NewConnection -&gt; ERRO 309 Failed connecting to orderer-1.orderer:7050 , error: x509: certificate signed by unknown authority
  [ConnProducer] NewConnection -&gt; ERRO 30a Failed connecting to orderer-0.orderer:7050 , error: x509: certificate signed by unknown authority
  [deliveryClient] connect -&gt; ERRO 30b Failed obtaining connection: Could not connect to any of the endpoints: [orderer-2.orderer:7050 orderer-1.orderer:7050 orderer-0.orderer:7050]`
  </code></pre>
  
  <p>And this is in the orderer log:</p>
  
  <pre><code>[grpc] Printf -&gt; DEBU 418 grpc: Server.Serve failed to complete security handshake from "172.17.0.16:56444": EOF
  </code></pre>
  
  <p>Clearly, something still is not right about that TLS certificate, but would anyone have an idea as to what might need to change?  Do I need to include the IP addresses of the servers as SANs in the TLS CSRs?</p>