{"record":{"id":"27805ed9aeb5463d","repo":"hyperledger/fabric","slug":"number-of-peer-addresses-d-does-not-match-the-n","errorCode":null,"errorMessage":"number of peer addresses (%d) does not match the number of TLS root cert files (%d)","messagePattern":"number of peer addresses \\((.+?)\\) does not match the number of TLS root cert files \\((.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/peer/chaincode/common.go","lineNumber":349,"sourceCode":"\t\t}\n\t}\n\n\t// currently only support multiple peer addresses for invoke\n\tmultiplePeersAllowed := map[string]bool{\n\t\t\"invoke\": true,\n\t}\n\t_, ok := multiplePeersAllowed[cmdName]\n\tif !ok && len(peerAddresses) > 1 {\n\t\treturn errors.Errorf(\"'%s' command can only be executed against one peer. received %d\", cmdName, len(peerAddresses))\n\t}\n\n\tif len(tlsRootCertFiles) > len(peerAddresses) {\n\t\tlogger.Warningf(\"received more TLS root cert files (%d) than peer addresses (%d)\", len(tlsRootCertFiles), len(peerAddresses))\n\t}\n\n\tif viper.GetBool(\"peer.tls.enabled\") {\n\t\tif len(tlsRootCertFiles) != len(peerAddresses) {\n\t\t\treturn errors.Errorf(\"number of peer addresses (%d) does not match the number of TLS root cert files (%d)\", len(peerAddresses), len(tlsRootCertFiles))\n\t\t}\n\t} else {\n\t\ttlsRootCertFiles = nil\n\t}\n\n\treturn nil\n}\n\n// ChaincodeCmdFactory holds the clients used by ChaincodeCmd\ntype ChaincodeCmdFactory struct {\n\tEndorserClients []pb.EndorserClient\n\tDeliverClients  []pb.DeliverClient\n\tCertificate     tls.Certificate\n\tSigner          identity.SignerSerializer\n\tBroadcastClient common.BroadcastClient\n}\n\n// InitCmdFactory init the ChaincodeCmdFactory with default clients","sourceCodeStart":331,"sourceCodeEnd":367,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/peer/chaincode/common.go#L331-L367","documentation":"validatePeerConnectionParameters enforces that when peer TLS is enabled (peer.tls.enabled), the number of --tlsRootCertFiles must exactly equal the number of --peerAddresses, since each peer connection needs its own CA cert. A mismatch is a hard error; more certs than addresses is only a warning when TLS is off.","triggerScenarios":"Running a peer chaincode command with peer.tls.enabled where len(tlsRootCertFiles) != len(peerAddresses) — e.g. supplying two peer addresses but one, or zero, --tlsRootCertFiles flags.","commonSituations":"Adding a peer address for multi-endorsement invoke but forgetting to add the matching TLS CA cert file, switching a script from non-TLS to TLS without adding certs, typos dropping one of repeated --tlsRootCertFiles flags.","solutions":["Supply one --tlsRootCertFiles flag per --peerAddresses flag, in matching order","Verify counts match: count --peerAddresses and --tlsRootCertFiles occurrences in the command","If TLS is disabled, ensure peer.tls.enabled is false consistently on the CLI node","Obtain the correct CA cert path for each org's peer from the connection profile"],"exampleFix":"// before\npeer chaincode invoke -C mychannel -n mycc -c '{\"Args\":[\"Invoke\"]}' --peerAddresses peer0.org1:7051 --peerAddresses peer0.org2:8051 --tlsRootCertFiles /certs/org1-ca.crt\n// after\npeer chaincode invoke -C mychannel -n mycc -c '{\"Args\":[\"Invoke\"]}' --peerAddresses peer0.org1:7051 --peerAddresses peer0.org2:8051 --tlsRootCertFiles /certs/org1-ca.crt --tlsRootCertFiles /certs/org2-ca.crt","handlingStrategy":"validation","validationCode":"NADDR=$(grep -o -- '--peerAddresses' <<<\"$CMD\" | wc -l); NCERT=$(grep -o -- '--tlsRootCertFiles' <<<\"$CMD\" | wc -l); [[ $NADDR -eq $NCERT ]] || { echo \"peer addresses ($NADDR) != tls certs ($NCERT)\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair each --peerAddresses with a --tlsRootCertFiles in the same order","Generate TLS flags from a single source list so counts can't diverge","Confirm peer.tls.enabled matches your deployment; disable the flag pairing only when TLS is truly off","Keep per-org CA cert paths in a config file and loop over them when composing the command"],"tags":["hyperledger-fabric","tls","cli","config-mismatch"],"backgroundTag":"tls-cert-count-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}