{"record":{"id":"32d73a9ebe5fe57f","repo":"hyperledger/fabric","slug":"could-not-connect-to-ordering-service","errorCode":null,"errorMessage":"could not connect to ordering service","messagePattern":"could not connect to ordering service","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/deliverclient/blocksprovider/bft_censorship_monitor.go","lineNumber":403,"sourceCode":"\tif !blockTime.IsZero() {\n\t\tblockNumber++ // If blockTime.IsZero(), we request block number 0, else blockNumber+1\n\t}\n\n\tif prevHeaderReceiver != nil {\n\t\thNum, _, errH := prevHeaderReceiver.LastBlockNum()\n\t\tif errH == nil && (hNum+1) > blockNumber {\n\t\t\tblockNumber = hNum + 1\n\t\t}\n\t}\n\n\tseekInfoEnv, err := m.requester.SeekInfoHeadersFrom(blockNumber)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"could not create a signed Deliver SeekInfo message, something is critically wrong\")\n\t}\n\n\tdeliverClient, clientCloser, err = m.requester.Connect(seekInfoEnv, endpoint)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"could not connect to ordering service\")\n\t}\n\n\treturn deliverClient, clientCloser, nil\n}\n","sourceCodeStart":385,"sourceCodeEnd":408,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/deliverclient/blocksprovider/bft_censorship_monitor.go#L385-L408","documentation":"This error is wrapped by newHeaderClient in the BFT censorship monitor when m.requester.Connect() fails to establish a deliver stream to the ordering service for a given endpoint. It means the monitor could not obtain a deliver client to receive block headers, so header receivers cannot be launched. The original transport/dial error is wrapped with the message \"could not connect to ordering service\".","triggerScenarios":"newHeaderClient calls m.requester.Connect(seekInfoEnv, endpoint) with a signed Deliver SeekInfo envelope; any error returned by Connect (dial failure, TLS handshake failure, endpoint unreachable) is wrapped with this message and returned to launchHeaderReceivers, aborting the monitor's header-receiver setup.","commonSituations":"Orderer endpoint is down or misconfigured in channel config; TLS root certificates are wrong or expired; the orderer address resolves but the deliver port is blocked by a firewall; DNS failures in Kubernetes/Docker networks; stale orderer addresses after orderer set changes.","solutions":["Verify the orderer endpoint (host:port) is reachable: nc/telnet to the address and confirm the orderer peer is running.","Check TLS configuration: ensure the client's tlscerts/channel crypto material matches the orderer's TLS CA and the certificate SANs include the orderer hostname.","Confirm channel configuration contains correct orderer addresses; update via configtx/config update if orderers changed.","Inspect orderer logs for deliver-side rejections and check network/firewall/DNS between client and orderer."],"exampleFix":"// before: orderer TLS CA missing from channel config -> Connect fails\n// after: correct TLS root certs in peer config and channel orderer endpoints\nexport FABRIC_CFG_PATH=/path/to/config\n# ensure peer channel TLS root certs contain orderer CA, then restart peer","handlingStrategy":"retry","validationCode":"// pre-check endpoint reachability before launching the monitor\nfunc checkOrdererReachable(addr string) error {\n    conn, err := net.DialTimeout(\"tcp\", addr, 3*time.Second)\n    if err != nil {\n        return fmt.Errorf(\"orderer %s unreachable: %w\", addr, err)\n    }\n    conn.Close()\n    return nil\n}","typeGuard":null,"tryCatchPattern":"deliverClient, closer, err := newHeaderClient(...)\nif err != nil {\n    var nested *wrpErr\n    if errors.As(err, &nested) && strings.Contains(err.Error(), \"could not connect to ordering service\") {\n        // log and retry with backoff / rotate endpoint\n        time.Sleep(backoff)\n        return retryNewHeaderClient()\n    }\n    return err\n}","preventionTips":["Validate orderer endpoints in channel config against running services before starting the monitor.","Keep TLS root certs for orderers current in peer crypto material.","Monitor orderer health with probes so failures are caught before deliver clients attempt to connect.","Use multiple orderer endpoints to survive single-orderer outages."],"tags":["network","connection","ordering-service","tls","fabric"],"backgroundTag":"ordering-service-connection-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}