{"record":{"id":"2f8bf4234a20e347","repo":"hyperledger/fabric","slug":"parsecertificate-failed","errorCode":null,"errorMessage":"parseCertificate failed","messagePattern":"parseCertificate failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":415,"sourceCode":"\t}\n\n\tif sId.Mspid != msp.name {\n\t\treturn nil, errors.Errorf(\"expected MSP ID %s, received %s\", msp.name, sId.Mspid)\n\t}\n\n\treturn msp.deserializeIdentityInternal(sId.IdBytes)\n}\n\n// deserializeIdentityInternal returns an identity given its byte-level representation\nfunc (msp *bccspmsp) deserializeIdentityInternal(serializedIdentity []byte) (Identity, error) {\n\t// This MSP will always deserialize certs this way\n\tbl, _ := pem.Decode(serializedIdentity)\n\tif bl == nil {\n\t\treturn nil, errors.New(\"could not decode the PEM structure\")\n\t}\n\tcert, err := x509.ParseCertificate(bl.Bytes)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"parseCertificate failed\")\n\t}\n\n\t// Now we have the certificate; make sure that its fields\n\t// (e.g. the Issuer.OU or the Subject.OU) match with the\n\t// MSP id that this MSP has; otherwise it might be an attack\n\t// TODO!\n\t// We can't do it yet because there is no standardized way\n\t// (yet) to encode the MSP ID into the x.509 body of a cert\n\n\tpub, err := msp.bccsp.KeyImport(cert, &bccsp.X509PublicKeyImportOpts{Temporary: true})\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"failed to import certificate's public key\")\n\t}\n\n\treturn newIdentity(cert, pub, msp)\n}\n\n// SatisfiesPrincipal returns nil if the identity matches the principal or an error otherwise","sourceCodeStart":397,"sourceCodeEnd":433,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L397-L433","documentation":"This error wraps x509.ParseCertificate failures inside deserializeIdentityInternal: the bytes decoded as a PEM block, but their DER payload is not a valid X.509 certificate. It surfaces with Go's pkg/errors wrapping ('parseCertificate failed: <cause>'), so the underlying cause (e.g. 'asn1: structure error') is appended and should be inspected.","triggerScenarios":"Calling msp.DeserializeIdentity with a PEM block whose Bytes are not parseable DER: corrupt/truncated cert, wrong PEM type (e.g. a PRIVATE KEY or CSR passed as identity), a certificate using unsupported/oversized fields, or payload altered in transit.","commonSituations":"Wrong file in the MSP admincerts/cert path (a key or CRL instead of a cert); copy-paste stripping characters from the base64 body; ASN.1 parse errors from certs generated with non-standard encodings; intermediate proxy corrupting binary payloads.","solutions":["Read the wrapped cause after 'parseCertificate failed:' to identify the exact ASN.1/x509 problem","Confirm the PEM block type is 'CERTIFICATE' and the base64 body is intact (lines of equal length, no missing chars)","Regenerate or re-export the certificate from the CA (e.g. cryptogen or fabric-ca-client enroll) and redeploy the MSP directory","If hand-converting DER, use x509.ParseCertificate locally first to validate before sending through the MSP"],"exampleFix":"// before\nbl, _ := pem.Decode(data)\nid, err := msp.DeserializeIdentity(data) // 'parseCertificate failed: asn1: structure error'\n// after\nbl, _ := pem.Decode(data)\nif bl.Type != \"CERTIFICATE\" {\n    return errors.Errorf(\"expected CERTIFICATE PEM, got %s\", bl.Type)\n}\nif _, err := x509.ParseCertificate(bl.Bytes); err != nil {\n    return err // fail fast with same cause, before MSP call\n}\nid, err := msp.DeserializeIdentity(data)","handlingStrategy":"try-catch","validationCode":"bl, _ := pem.Decode(b)\nif bl != nil {\n    if _, err := x509.ParseCertificate(bl.Bytes); err != nil {\n        return fmt.Errorf(\"identity payload is not a valid X.509 cert: %w\", err)\n    }\n}","typeGuard":"func isParseableCertificate(b []byte) bool {\n    bl, _ := pem.Decode(b)\n    if bl == nil || bl.Type != \"CERTIFICATE\" {\n        return false\n    }\n    _, err := x509.ParseCertificate(bl.Bytes)\n    return err == nil\n}","tryCatchPattern":"id, err := msp.DeserializeIdentity(b)\nif err != nil {\n    if strings.HasPrefix(err.Error(), \"parseCertificate failed\") {\n        log.Errorf(\"bad cert payload: %v\", err) // cause appended after the prefix\n    }\n    return err\n}","preventionTips":["Read the wrapped cause after 'parseCertificate failed:' to pinpoint the ASN.1 problem","Confirm PEM block Type is 'CERTIFICATE' — not a PRIVATE KEY, CSR, or CRL","Regenerate certs from fabric-ca/cryptogen rather than hand-editing base64 bodies","Round-trip validate with x509.ParseCertificate before submitting identities to the MSP"],"tags":["x509","certificate","asn1","msp","hyperledger-fabric"],"backgroundTag":"x509-certificate-parse-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}