{"record":{"id":"091229dc4f39c4a2","repo":"hyperledger/fabric","slug":"failed-exporting-keying-material","errorCode":null,"errorMessage":"failed exporting keying material","messagePattern":"failed exporting keying material","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/util.go","lineNumber":707,"sourceCode":"\treturn util.ComputeSHA256(util.ConcatenateBytes(\n\t\t[]byte(strconv.FormatUint(uint64(authReq.Version), 10)),\n\t\tEncodeTimestamp(authReq.Timestamp),\n\t\t[]byte(strconv.FormatUint(authReq.FromId, 10)),\n\t\t[]byte(strconv.FormatUint(authReq.ToId, 10)),\n\t\t[]byte(authReq.Channel),\n\t))\n}\n\nfunc GetTLSSessionBinding(ctx context.Context, bindingPayload []byte) ([]byte, error) {\n\tpeerInfo, ok := peer.FromContext(ctx)\n\tif !ok {\n\t\treturn nil, errors.New(\"failed extracting stream context\")\n\t}\n\tconnState := peerInfo.AuthInfo.(credentials.TLSInfo).State\n\n\ttlsBinding, err := exportKM(connState, KeyingMaterialLabel, bindingPayload)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed exporting keying material\")\n\t}\n\n\treturn tlsBinding, nil\n}\n\nfunc VerifySignature(identity, msgHash, signature []byte) error {\n\tblock, _ := pem.Decode(identity)\n\tif block == nil {\n\t\treturn errors.New(\"pem decoding failed\")\n\t}\n\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"key extraction failed\")\n\t}\n\n\tpubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)\n\tif !isECDSA {","sourceCodeStart":689,"sourceCodeEnd":725,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/util.go#L689-L725","documentation":"After the peer context is extracted, GetTLSSessionBinding exports RFC 5705 keying material from the connection's TLS state via exportKM. If that export fails (nil or unusable TLS connection state), the underlying error is wrapped with this message.","triggerScenarios":"The peer's AuthInfo contains a credentials.TLSInfo whose ConnectionState cannot be used for exporter calls — e.g. the TLS handshake was resumed/renegotiated differently, exporter is not available, or the connection state is zero-valued in a non-standard transport implementation.","commonSituations":"Proxy/terminating-TLS deployments where the orderer's gRPC connection is not the TLS session the client thinks it is; unusual TLS stacks or test fakes supplying incomplete credentials.TLSInfo; TLS version mismatches (TLS 1.0/1.1 without exporter support).","solutions":["Ensure TLS 1.2+ end-to-end between client and orderer (no TLS termination at a proxy)","Verify both peers negotiate a TLS version/cipher suite supporting keying-material export","Check that the connection state passed to exportKM comes from the live connection (peerInfo.AuthInfo), not a cached stale one","Inspect the wrapped inner error in the log to identify the exact exporter failure"],"exampleFix":"// before\nconn, _ := grpc.Dial(addr, grpc.WithInsecure()) // no TLS -> binding will fail downstream\n// after\nconn, _ := grpc.Dial(addr, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))","handlingStrategy":"try-catch","validationCode":"if pi, ok := peer.FromContext(ctx); ok {\n    tlsInfo, ok := pi.AuthInfo.(credentials.TLSInfo)\n    if !ok || tlsInfo.State.Version == 0 {\n        return errors.New(\"no usable TLS connection state in peer auth info\")\n    }\n}","typeGuard":"func hasExportableTLS(ctx context.Context) bool {\n    pi, ok := peer.FromContext(ctx)\n    if !ok { return false }\n    tlsInfo, ok := pi.AuthInfo.(credentials.TLSInfo)\n    return ok && tlsInfo.State.ESA != nil || ok && tlsInfo.State.Version != 0\n}","tryCatchPattern":"binding, err := cluster.GetTLSSessionBinding(ctx, payload)\nif err != nil {\n    var inner string = err.Error()\n    if strings.Contains(inner, \"failed exporting keying material\") {\n        logger.Warningf(\"TLS exporter unavailable: %v (check TLS version/termination)\", err)\n    }\n    return err\n}","preventionTips":["Use TLS 1.2+ with exporter-capable cipher suites end to end","Avoid TLS-terminating proxies in front of orderers","Log wrapped cause errors (%+v) to surface the exporter failure","Pin TLS config in both client and server dial options"],"tags":["tls","keying-material","grpc"],"backgroundTag":"tls-keying-material-export-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}