I just use first-network and enable TLS on client (by modifying the docker-compose files on orderer, peers and cli). I first perform
./byfn.sh up and it works well. Then I perform the same process of adding Org3 per tutorial. The only thing I have modified is Org3Cli to include TLS client environment variables. No modification on the two peer nodes as they use the
peer-base.yaml, which i have updated already.
The whole process is successful.
Let me know if you need a quick procedure and I can share a google doc to you on the detail.