{"record":{"id":"226b0850fe6de8bf","repo":"hyperledger/fabric","slug":"access-denied-channel-s-creator-org-s","errorCode":null,"errorMessage":"access denied: channel [%s] creator org [%s]","messagePattern":"access denied: channel \\[(.+?)\\] creator org \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/endorser/msgvalidation.go","lineNumber":176,"sourceCode":"\t\treturn errors.Errorf(\"incorrectly computed txid '%s' -- expected '%s'\", up.TxID(), expectedTxID)\n\t}\n\n\tif up.SignedProposal.ProposalBytes == nil {\n\t\treturn errors.Errorf(\"empty proposal bytes\")\n\t}\n\n\tif up.SignedProposal.Signature == nil {\n\t\treturn errors.Errorf(\"empty signature bytes\")\n\t}\n\n\t// get the identity of the creator\n\tcreator, err := idDeserializer.DeserializeIdentity(up.SignatureHeader.Creator)\n\tif err != nil {\n\t\tlogger.Warnw(\"access denied\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(up.SignatureHeader.Creator))\n\t\treturn errors.Errorf(\"access denied: channel [%s] creator org unknown, creator is malformed\", up.ChannelID())\n\t}\n\n\tgenericAuthError := errors.Errorf(\"access denied: channel [%s] creator org [%s]\", up.ChannelID(), creator.GetMSPIdentifier())\n\t// ensure that creator is a valid certificate\n\terr = creator.Validate()\n\tif err != nil {\n\t\tlogger.Warnw(\"access denied: identity is not valid\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(up.SignatureHeader.Creator))\n\t\treturn genericAuthError\n\t}\n\n\tlogger = logger.With(\"mspID\", creator.GetMSPIdentifier())\n\n\tlogger.Debug(\"creator is valid\")\n\n\t// validate the signature\n\terr = creator.Verify(up.SignedProposal.ProposalBytes, up.SignedProposal.Signature)\n\tif err != nil {\n\t\tlogger.Warnw(\"access denied: creator's signature over the proposal is not valid\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(up.SignatureHeader.Creator))\n\t\treturn genericAuthError\n\t}\n","sourceCodeStart":158,"sourceCodeEnd":194,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/endorser/msgvalidation.go#L158-L194","documentation":"The endorser could not authenticate the transaction's creator. After deserializing the identity from the proposal's SignatureHeader, creator.Validate() fails (expired/revoked certificate, unknown MSP, malformed cert), so the endorser rejects the proposal with this generic authorization error naming the channel and the MSP ID derived from the creator identity.","triggerScenarios":"ProcessProposal -> preProcess -> Validate where idDeserializer.DeserializeIdentity succeeds but creator.Validate() returns an error, e.g. the client's signing certificate has expired, was revoked, is not issued by an MSP known to the peer, or the serialized identity bytes are corrupt.","commonSituations":"Client SDK using an expired or rotated enrollment cert; peer's MSP config (mspConfigPath) missing the org's CA cert; cryptogen/fabric-ca certs regenerated after peer joined channel; copying wallets between environments; clock skew making a valid cert appear invalid.","solutions":["Regenerate or renew the client's signing certificate/keystore (e.g. re-enroll with fabric-ca) and update the SDK wallet","Verify the peer's MSP configuration contains the CA that issued the creator identity (core.yaml peer.mspConfigPath / channel MSP)","Confirm the org's MSP is defined in the channel config and the client signs with an identity from that MSP","Check peer logs for the preceding 'access denied: identity is not valid' warning with the underlying x509 error to pinpoint cert validity issues"],"exampleFix":"// before: stale cert in connection profile\nconst gateway = await connect({ identity: await wallet.get('expiredUser'), ... });\n// after: re-enroll and store fresh identity\nconst enrollment = await ca.registerAndEnroll({ enrollmentID: 'user1', affiliation: 'org1.department1' });\nawait wallet.put('user1', new X509WalletIdentity({ mspId: 'Org1MSP', cert: enrollment.certificate, key: enrollment.key }));","handlingStrategy":"validation","validationCode":"const cert = new crypto.X509Certificate(identityCertPem);\nif (cert.validityDateEnd < new Date()) throw new Error('client cert expired; re-enroll before submitting');\n// also confirm the issuing CA cert exists in the peer org's MSP folder\n","typeGuard":"function hasValidIdentity(walletIdentity) {\n  return Boolean(walletIdentity && walletIdentity.mspId && walletIdentity.credentials?.certificate && walletIdentity.credentials?.privateKey);\n}","tryCatchPattern":"try {\n  await contract.submitTransaction('fn', 'arg');\n} catch (e) {\n  if (/access denied: channel \\[.*\\] creator org/.test(e.message)) {\n    await reEnrollAndReplaceWalletIdentity(); // invalid/expired creator cert\n  }\n  throw e;\n}","preventionTips":["Monitor certificate expiry and re-enroll clients before expiration","Keep peer/channel MSP configs in sync with the CA that issues client certs","After regenerating network crypto material, always refresh SDK wallets","Pin identities per environment; never reuse wallets across networks"],"tags":["hyperledger-fabric","endorser","msp","authentication","certificate"],"backgroundTag":"invalid-client-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}