{"record":{"id":"0ab7aebced4459ec","repo":"hyperledger/fabric","slug":"could-not-load-signing-certificate-from-directory","errorCode":null,"errorMessage":"could not load signing certificate from directory %s","messagePattern":"could not load signing certificate from directory (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/configbuilder.go","lineNumber":181,"sourceCode":"\t\treturn idemix.GetIdemixMspConfig(dir, ID)\n\tdefault:\n\t\treturn nil, errors.Errorf(\"unknown MSP type '%s'\", mspType)\n\t}\n}\n\nfunc GetLocalMspConfig(dir string, bccspConfig *factory.FactoryOpts, ID string) (*msp.MSPConfig, error) {\n\tsigncertDir := filepath.Join(dir, signcerts)\n\tkeystoreDir := filepath.Join(dir, keystore)\n\tbccspConfig = SetupBCCSPKeystoreConfig(bccspConfig, keystoreDir)\n\n\terr := factory.InitFactories(bccspConfig)\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"could not initialize BCCSP Factories\")\n\t}\n\n\tsigncert, err := getPemMaterialFromDir(signcertDir)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"could not load signing certificate from directory %s\", signcertDir)\n\t} else if len(signcert) == 0 {\n\t\treturn nil, errors.Errorf(\"no signing certificate found in directory %s\", signcertDir)\n\t}\n\n\t/* FIXME: for now we're making the following assumptions\n\t1) there is exactly one signing cert\n\t2) BCCSP's KeyStore has the private key that matches SKI of\n\t   signing cert\n\t*/\n\n\tsigid := &msp.SigningIdentityInfo{PublicSigner: signcert[0], PrivateSigner: nil}\n\n\treturn getMspConfig(dir, ID, sigid)\n}\n\n// GetVerifyingMspConfig returns an MSP config given directory, ID and type\nfunc GetVerifyingMspConfig(dir, ID, mspType string) (*msp.MSPConfig, error) {\n\tswitch mspType {","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/configbuilder.go#L163-L199","documentation":"GetLocalMspConfig assembles the local (node) MSP config and needs at least one signing certificate from <msp-dir>/signcerts. This error wraps a getPemMaterialFromDir failure (unreadable dir or a bad PEM file inside it) with the signcerts path.","triggerScenarios":"Calling GetLocalMspConfig/GetLocalMspConfigWithType (e.g. via InitCrypto) where the signcerts directory cannot be read, contains an unreadable/non-PEM file, or a symlink error occurs while loading it.","commonSituations":"MSP dir missing the signcerts folder, wrong CORE_PEER_MSPCONFIGPATH, permission problems, a corrupted PEM inside signcerts causing readPemFile to fail, container not mounting the cert volume.","solutions":["Ensure <msp-dir>/signcerts contains a readable PEM signing cert and the dir is accessible","Fix the file/dir permissions reported by the wrapped error","Regenerate the local MSP with cryptogen generate or fabric-ca enroll to restore signcerts","Validate the cert: 'openssl x509 -in signcerts/*.pem -noout'"],"exampleFix":"// before: empty MSP without signcerts\nGetLocalMspConfig(\"/tmp/msp-empty\", ...) // error\n// after\n// cp admincerts/peer.pem /tmp/msp/signcerts/peer-signed.pem\nGetLocalMspConfig(\"/tmp/msp\", ...)","handlingStrategy":"validation","validationCode":"func signingCertPresent(root string) error {\n    dir := filepath.Join(root, \"signcerts\")\n    entries, err := os.ReadDir(dir)\n    if err != nil { return err }\n    for _, e := range entries {\n        b, err := os.ReadFile(filepath.Join(dir, e.Name()))\n        if err != nil { return err }\n        if pem.Decode(b) != nil { return nil }\n    }\n    return fmt.Errorf(\"no valid PEM signing cert in %s\", dir)\n}","typeGuard":null,"tryCatchPattern":"if err := InitCrypto(bsp, mspPath, id); err != nil {\n    if strings.Contains(err.Error(), \"could not load signing certificate\") {\n        return fmt.Errorf(\"fix %s/signcerts: unreadable or invalid PEM\", filepath.Join(mspPath, \"signcerts\"))\n    }\n    return err\n}","preventionTips":["Always enroll/enroll-and-copy complete MSP layouts from fabric-ca or cryptogen","Keep keystore (private key) and signcerts (cert) populated together","Run as a user with read access to the MSP tree","CI check: assert exactly one parseable cert in signcerts before shipping"],"tags":["msp","signing-certificate","filesystem","configuration"],"backgroundTag":"missing-signing-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}