{"record":{"id":"2d78fcddea873e81","repo":"hyperledger/fabric","slug":"failed-to-unmarshal-aki","errorCode":null,"errorMessage":"failed to unmarshal AKI","messagePattern":"failed to unmarshal AKI","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":342,"sourceCode":"type authorityKeyIdentifier struct {\n\tKeyIdentifier             []byte  `asn1:\"optional,tag:0\"`\n\tAuthorityCertIssuer       []byte  `asn1:\"optional,tag:1\"`\n\tAuthorityCertSerialNumber big.Int `asn1:\"optional,tag:2\"`\n}\n\n// getAuthorityKeyIdentifierFromCrl returns the Authority Key Identifier\n// for the supplied CRL. The authority key identifier can be used to identify\n// the public key corresponding to the private key which was used to sign the CRL.\nfunc getAuthorityKeyIdentifierFromCrl(crl *pkix.CertificateList) ([]byte, error) {\n\taki := authorityKeyIdentifier{}\n\n\tfor _, ext := range crl.TBSCertList.Extensions {\n\t\t// Authority Key Identifier is identified by the following ASN.1 tag\n\t\t// authorityKeyIdentifier (2 5 29 35) (see https://tools.ietf.org/html/rfc3280.html)\n\t\tif reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 35}) {\n\t\t\t_, err := asn1.Unmarshal(ext.Value, &aki)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to unmarshal AKI\")\n\t\t\t}\n\n\t\t\treturn aki.KeyIdentifier, nil\n\t\t}\n\t}\n\n\treturn nil, errors.New(\"authorityKeyIdentifier not found in certificate\")\n}\n\n// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate\n// Subject Key Identifier is an identifier of the public key of this certificate\nfunc getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {\n\tvar SKI []byte\n\n\tfor _, ext := range cert.Extensions {\n\t\t// Subject Key Identifier is identified by the following ASN.1 tag\n\t\t// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)\n\t\tif reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L324-L360","documentation":"While extracting the Authority Key Identifier (AKI) from a CRL's TBSCertList extensions (OID 2.5.29.35), the ASN.1 unmarshal of the extension value failed. Fabric wraps the parse error as 'failed to unmarshal AKI' because the CRL is needed to check whether the certificate in the chain was revoked.","triggerScenarios":"validateCertAgainstChain calls getAuthorityKeyIdentifierFromCrl on a CRL whose authorityKeyIdentifier extension value is malformed or not DER-encoded per PKIX.","commonSituations":"Hand-crafted or truncated CRL PEM in the intermediates/crl folder of the MSP; CRL produced by a non-compliant tool; binary corruption of the CRL file.","solutions":["Regenerate the CRL with a standards-compliant tool (openssl ca -gencrl or fabric-ca)","Verify the CRL: openssl crl -in crl.pem -noout -text and confirm the AKI extension parses","Remove the malformed CRL file from the MSP's crls directory if revocation checking against it is not required"],"exampleFix":"// before: manually concatenated/corrupt CRL\ncat partial.crl.pem > msp/crls/crl.pem\n// after: regenerate properly\nopenssl ca -gencrl -keyfile ca.key -cert ca.pem -out msp/crls/crl.pem","handlingStrategy":"validation","validationCode":"import (\"encoding/pem\"; \"crypto/x509/pkix\")\nfunc checkCRLParses(crlPEM []byte) error {\n    blk, _ := pem.Decode(crlPEM)\n    if blk == nil { return fmt.Errorf(\"not PEM\") }\n    crl, err := x509.ParseRevocationList(blk.Bytes)\n    if err != nil { return err }\n    if crl.AuthorityKeyId == nil { return fmt.Errorf(\"missing AKI\") }\n    return nil\n}\n// Run over each file in msp/crls before MSP setup.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate CRLs only with openssl or fabric-ca, never by hand","Validate every CRL with openssl crl -noout -text before installing into msp/crls","Regenerate CRLs after CA key rotation"],"tags":["fabric","msp","crl","asn1"],"backgroundTag":"x509-extension-parse-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}