Secure communications in a blockchain network

A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:

• obtaining, by a first node of a blockchain network, a first certificate authority (CA) trust list comprising a plurality of CA identifiers;
• receiving, by the first node from a second node of the blockchain network, a communication request comprising a public key certificate of the second node;
• determining, by the first node of the blockchain network, a first CA identifier from the received public key certificate of the second node of the blockchain network;
• determining, by the first node of the blockchain network, that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list;
• in response to determining that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list, approving, by the first node of the blockchain network, the communication request, comprising
• transmitting, by the first node of the blockchain network and to the second node of the blockchain network, a verification request for the second node to determine whether a second CA identifier corresponding to a public key certificate of the first node matches one of a plurality of CA identifiers included in a second CA trust list of the second node, wherein the verification request comprises the public key certificate of the first node;
• determining, by the second node, the second CA identifier from the received public key certificate of the first node;
• determining whether the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list of the second node;
• in response to determining that the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list, establishing a communication session with the first node;
• and
• in response to determining that the second CA identifier does not match one of the plurality of CA identifiers of the second CA trust list, denying, by the second node, establishment of the communication session with the first node.

A computer-implemented system, comprising:

• one or more computers;
• and
• one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising:
• obtaining, by a first node of a blockchain network, a first certificate authority (CA) trust list comprising a plurality of CA identifiers;
• receiving, by the first node from a second node of the blockchain network, a communication request comprising a public key certificate of the second node;
• determining, by the first node of the blockchain network, a first CA identifier from the received public key certificate of the second node of the blockchain network;
• determining, by the first node of the blockchain network, that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list;
• in response to determining that the first CA identifier matches one of the plurality of CA identifiers of the first CA trust list, approving, by the first node of the blockchain network, the communication request, comprising
• transmitting, by the first node of the blockchain network and to the second node of the blockchain network, a verification request for the second node to determine whether a second CA identifier corresponding to a public key certificate of the first node matches one of a plurality of CA identifiers included in a second CA trust list of the second node, wherein the verification request comprises the public key certificate of the first node;
• determining, by the second node, the second CA identifier from the received public key certificate of the first node;
• determining whether the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list of the second node;
• in response to determining that the second CA identifier matches one of the plurality of CA identifiers of the second CA trust list, establishing a communication session with the first node;
• and
• in response to determining that the second CA identifier does not match one of the plurality of CA identifiers of the second CA trust list, denying, by the second node, establishment of the communication session with the first node.