{"record":{"id":"157ca4d6354d2aca","repo":"hyperledger/fabric","slug":"authoritykeyidentifier-not-found-in-certificate","errorCode":null,"errorMessage":"authorityKeyIdentifier not found in certificate","messagePattern":"authorityKeyIdentifier not found in certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":349,"sourceCode":"// for the supplied CRL. The authority key identifier can be used to identify\n// the public key corresponding to the private key which was used to sign the CRL.\nfunc getAuthorityKeyIdentifierFromCrl(crl *pkix.CertificateList) ([]byte, error) {\n\taki := authorityKeyIdentifier{}\n\n\tfor _, ext := range crl.TBSCertList.Extensions {\n\t\t// Authority Key Identifier is identified by the following ASN.1 tag\n\t\t// authorityKeyIdentifier (2 5 29 35) (see https://tools.ietf.org/html/rfc3280.html)\n\t\tif reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 35}) {\n\t\t\t_, err := asn1.Unmarshal(ext.Value, &aki)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to unmarshal AKI\")\n\t\t\t}\n\n\t\t\treturn aki.KeyIdentifier, nil\n\t\t}\n\t}\n\n\treturn nil, errors.New(\"authorityKeyIdentifier not found in certificate\")\n}\n\n// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate\n// Subject Key Identifier is an identifier of the public key of this certificate\nfunc getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {\n\tvar SKI []byte\n\n\tfor _, ext := range cert.Extensions {\n\t\t// Subject Key Identifier is identified by the following ASN.1 tag\n\t\t// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)\n\t\tif reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {\n\t\t\t_, err := asn1.Unmarshal(ext.Value, &SKI)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to unmarshal Subject Key Identifier\")\n\t\t\t}\n\n\t\t\treturn SKI, nil\n\t\t}","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L331-L367","documentation":"The CRL supplied to the MSP does not contain an Authority Key Identifier extension (OID 2.5.29.35), so getAuthorityKeyIdentifierFromCrl cannot determine which CA issued the revoked certificates and returns this error. Fabric requires the AKI to correlate the CRL with the CA in the validation chain.","triggerScenarios":"validateCertAgainstChain iterates crl.TBSCertList.Extensions and finds no extension equal to asn1.ObjectIdentifier{2,5,29,35}; getAuthorityKeyIdentifierFromCrl returns errors.New(\"authorityKeyIdentifier not found in certificate\").","commonSituations":"CRL generated without the crl_extensions option (openssl cnf missing 'crl_extensions = crl_ext' and 'authorityKeyIdentifier=keyid:always'); minimal CRLs from custom tooling; very old CRL formats.","solutions":["Regenerate the CRL with AKI included: in openssl.cnf set crl_extensions = crl_ext and in [crl_ext] authorityKeyIdentifier=keyid:always","Issue the CRL from a CA whose configuration includes the AKI extension","Use fabric-ca to generate revocation lists, which include the AKI extension"],"exampleFix":"# before: openssl.cnf CA default section lacks CRL extensions\n# after\n[ ca ]\ncrl_extensions = crl_ext\n[ crl_ext ]\nauthorityKeyIdentifier = keyid:always","handlingStrategy":"validation","validationCode":"import (\"encoding/pem\"; \"crypto/x509\")\nfunc crlHasAKI(crlPEM []byte) bool {\n    blk, _ := pem.Decode(crlPEM)\n    if blk == nil { return false }\n    crl, err := x509.ParseRevocationList(blk.Bytes)\n    if err != nil { return false }\n    return len(crl.AuthorityKeyId) > 0\n}\n// Return false -> Fabric will reject the CRL; regenerate with AKI extension.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable crl_extensions with authorityKeyIdentifier in the openssl CA config","Verify with: openssl crl -in crl.pem -noout -text | grep -A2 'Authority Key'","Prefer fabric-ca revocation workflows that emit compliant CRLs"],"tags":["fabric","msp","crl","x509"],"backgroundTag":"x509-extension-missing","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}