{"record":{"id":"00c356ea94683539","repo":"hyperledger/fabric","slug":"the-identity-is-not-valid-under-this-msp-s","errorCode":null,"errorMessage":"The identity is not valid under this MSP [%s]","messagePattern":"The identity is not valid under this MSP \\[(.+?)\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":524,"sourceCode":"\t\tcase m.MSPRole_MEMBER:\n\t\t\t// in the case of member, we simply check\n\t\t\t// whether this identity is valid for the MSP\n\t\t\tmspLogger.Debugf(\"Checking if identity satisfies MEMBER role for %s\", msp.name)\n\t\t\treturn msp.Validate(id)\n\t\tcase m.MSPRole_ADMIN:\n\t\t\tmspLogger.Debugf(\"Checking if identity satisfies ADMIN role for %s\", msp.name)\n\t\t\t// in the case of admin, we check that the\n\t\t\t// id is exactly one of our admins\n\t\t\tif msp.isInAdmins(id.(*identity)) {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn errors.New(\"This identity is not an admin\")\n\t\tcase m.MSPRole_CLIENT:\n\t\t\tfallthrough\n\t\tcase m.MSPRole_PEER:\n\t\t\tmspLogger.Debugf(\"Checking if identity satisfies role [%s] for %s\", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)\n\t\t\tif err := msp.Validate(id); err != nil {\n\t\t\t\treturn errors.Wrapf(err, \"The identity is not valid under this MSP [%s]\", msp.name)\n\t\t\t}\n\n\t\t\tif err := msp.hasOURole(id, mspRole.Role); err != nil {\n\t\t\t\treturn errors.Wrapf(err, \"The identity is not a [%s] under this MSP [%s]\", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)\n\t\t\t}\n\t\t\treturn nil\n\t\tdefault:\n\t\t\treturn errors.Errorf(\"invalid MSP role type %d\", int32(mspRole.Role))\n\t\t}\n\tcase m.MSPPrincipal_IDENTITY:\n\t\t// in this case we have to deserialize the principal's identity\n\t\t// and compare it byte-by-byte with our cert\n\t\tprincipalId, err := msp.DeserializeIdentity(principal.Principal)\n\t\tif err != nil {\n\t\t\treturn errors.WithMessage(err, \"invalid identity principal, not a certificate\")\n\t\t}\n\n\t\tif bytes.Equal(id.(*identity).cert.Raw, principalId.(*identity).cert.Raw) {","sourceCodeStart":506,"sourceCodeEnd":542,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L506-L542","documentation":"Raised when evaluating a CLIENT or PEER MSPRole principal: msp.Validate(id) failed, so the wrapped message reports that the identity is not valid under the referenced MSP. Validation includes signature/path verification, certificate expiry/revocation, OU/organization-unit checks, and certification-chain trust against the MSP's root certs.","triggerScenarios":"Checking a policy with MSPRole_CLIENT/MSPRole_PEER where Validate() rejects the identity — expired or not-yet-valid enrollment certificate, certificate signed by an unknown root/intermediate, revoked cert, missing intermediate certs in the chain, or NodeOUs configuration rejecting the cert's OU/type.","commonSituations":"Enrollment certificates expired (fabric-ca 1-year defaults); peer restarted with updated root certs while client holds an old cert; intermediates not included in the presented chain; FabricNodeOUs enabled but identity lacks the required client/peer OU; clock skew on the client host.","solutions":["Read the wrapped inner error (validateIdentity internals) to see the exact cause: expired, untrusted chain, revoked, or bad OU.","Re-enroll or renew the identity's certificate via fabric-ca and update the wallet.","Ensure the full certificate chain (intermediates) is trusted in the MSP config of the channel (rootcerts/intermediatecerts).","Check the host clock (NTP) and FabricNodeOUs/OUIdentifiers config if OU-based classification is in use."],"exampleFix":"// before: expired cert in wallet\nx509id, _ := identity.NewX509Identity(mspID, signerCert, signerKey) // signerCert expired\n\n// after: re-enroll and refresh credentials\nfabric-ca-client reenroll -u https://ca.example.com:7054\n// load new cert/key into the wallet before evaluating the policy","handlingStrategy":"try-catch","validationCode":"// check cert validity locally before evaluation\nfunc certUsable(pemBytes []byte) error {\n\tcert, err := x509.ParseCertificate(pemToDER(pemBytes))\n\tif err != nil {\n\t\treturn err\n\t}\n\tnow := time.Now()\n\tif now.Before(cert.NotBefore) || now.After(cert.NotAfter) {\n\t\treturn fmt.Errorf(\"certificate not valid: %v..%v\", cert.NotBefore, cert.NotAfter)\n\t}\n\treturn nil\n}","typeGuard":"func isTrustedIdentity(id msp.Identity, m msp.MSP) bool {\n\treturn m.Validate(id) == nil\n}","tryCatchPattern":"if err := policy.Evaluate(id); err != nil {\n\tif strings.Contains(err.Error(), \"not valid under this MSP\") {\n\t\t// renew cert via fabric-ca-client reenroll, reload wallet, then retry once\n\t\trenewAndRetry(ctx)\n\t}\n\treturn err\n}","preventionTips":["Monitor enrollment certificate expiry (fabric-ca default 1y) and automate re-enrollment.","Include the full intermediate chain in every presented certificate.","Keep channel root/intermediate certs in sync with CA changes before old certs expire.","Synchronize host clocks with NTP to avoid NotBefore failures."],"tags":["hyperledger-fabric","msp","certificate-validation","policy"],"backgroundTag":"certificate-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}