{"record":{"id":"20c907c4bed22ff5","repo":"hyperledger/fabric","slug":"enrollment-certificate-is-not-a-valid-x509-certifi","errorCode":null,"errorMessage":"enrollment certificate is not a valid x509 certificate: %v","messagePattern":"enrollment certificate is not a valid x509 certificate: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/common/signer/signer.go","lineNumber":91,"sourceCode":"\tsId := &msp.SerializedIdentity{\n\t\tMspid:   mspID,\n\t\tIdBytes: b,\n\t}\n\treturn protoutil.MarshalOrPanic(sId), nil\n}\n\nfunc validateEnrollmentCertificate(b []byte) error {\n\tbl, _ := pem.Decode(b)\n\tif bl == nil {\n\t\treturn errors.Errorf(\"enrollment certificate isn't a valid PEM block\")\n\t}\n\n\tif bl.Type != \"CERTIFICATE\" {\n\t\treturn errors.Errorf(\"enrollment certificate should be a certificate, got a %s instead\", strings.ToLower(bl.Type))\n\t}\n\n\tif _, err := x509.ParseCertificate(bl.Bytes); err != nil {\n\t\treturn errors.Errorf(\"enrollment certificate is not a valid x509 certificate: %v\", err)\n\t}\n\treturn nil\n}\n\nfunc (si *Signer) Sign(msg []byte) ([]byte, error) {\n\tswitch key := si.key.(type) {\n\t// Fabric only supports ECDSA and ed25519 at the moment.\n\tcase *ecdsa.PrivateKey:\n\t\tdigest := util.ComputeSHA256(msg)\n\t\treturn signECDSA(si.key.(*ecdsa.PrivateKey), digest)\n\tcase ed25519.PrivateKey:\n\t\treturn ed25519.Sign(si.key.(ed25519.PrivateKey), msg), nil\n\tdefault:\n\t\treturn nil, errors.Errorf(\"found unknown private key type (%T) in msg signing\", key)\n\t}\n}\n\nfunc loadPrivateKey(file string) (crypto.PrivateKey, error) {","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/cmd/common/signer/signer.go#L73-L109","documentation":"When the PEM block has type CERTIFICATE, validateEnrollmentCertificate further parses the DER contents with x509.ParseCertificate. If the DER payload is not a valid X.509 certificate, the error includes the underlying parse error. This catches corrupted or mislabeled certificates.","triggerScenarios":"pem.Decode succeeds with type CERTIFICATE but the base64 body is corrupted, truncated, or contains non-certificate data (e.g. hand-edited PEM, copy/paste damage, wrong encoding).","commonSituations":"Certificate truncated during transfer (missing trailing lines); manual copy/paste from a terminal that wrapped lines; binary corruption in storage; a fake/test PEM block.","solutions":["Re-obtain the certificate from the CA or the MSP directory and overwrite the corrupted file","Validate manually: openssl x509 -in cert.pem -noout -text must succeed","Re-copy the PEM avoiding terminal line-wrap corruption; verify base64 decodes cleanly (base64 -d)","Check file size vs. the original / re-download"],"exampleFix":"// verify before use\n$ openssl x509 -in cert.pem -noout -text\n// if it fails, re-export:\nfabric-ca-client certificate list / re-enroll to get a fresh cert.pem","handlingStrategy":"validation","validationCode":"if _, err := x509.ParseCertificate(pemBlock.Bytes); err != nil {\n    return fmt.Errorf(\"corrupt certificate: %w\", err)\n}","typeGuard":"func validX509(b []byte) bool {\n    blk, _ := pem.Decode(b)\n    if blk == nil { return false }\n    _, err := x509.ParseCertificate(blk.Bytes)\n    return err == nil\n}","tryCatchPattern":"if err := validateEnrollmentCertificate(b); err != nil {\n    if strings.Contains(err.Error(), \"not a valid x509\") {\n        return fmt.Errorf(\"certificate corrupt — re-export: %w\", err)\n    }\n    return err\n}","preventionTips":["Verify with openssl x509 -noout -text after every material copy","Avoid copy/pasting certs through terminals; use scp/rsync","Checksum-verify material bundles when transferring"],"tags":["x509","certificate","fabric","corruption"],"backgroundTag":"invalid-x509-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}