{"record":{"id":"3faf73a48ffb256c","repo":"hyperledger/fabric","slug":"failed-classifying-identity","errorCode":null,"errorMessage":"failed classifying identity","messagePattern":"failed classifying identity","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"gossip/identity/identity.go","lineNumber":113,"sourceCode":"\t\t\t\treturn false\n\t\t\t})\n\t\t}\n\t}\n}\n\n// put associates an identity to its given pkiID, and returns an error\n// in case the given pkiID doesn't match the identity\nfunc (is *identityMapperImpl) Put(pkiID common.PKIidType, identity api.PeerIdentityType) error {\n\tif pkiID == nil {\n\t\treturn errors.New(\"PKIID is nil\")\n\t}\n\tif identity == nil {\n\t\treturn errors.New(\"identity is nil\")\n\t}\n\n\texpirationDate, err := is.mcs.Expiration(identity)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed classifying identity\")\n\t}\n\n\tif err := is.mcs.ValidateIdentity(identity); err != nil {\n\t\treturn err\n\t}\n\n\tid := is.mcs.GetPKIidOfCert(identity)\n\tif !bytes.Equal(pkiID, id) {\n\t\treturn errors.New(\"identity doesn't match the computed pkiID\")\n\t}\n\n\tis.Lock()\n\tdefer is.Unlock()\n\t// Check if identity already exists.\n\t// If so, no need to overwrite it.\n\tif _, exists := is.pkiID2Cert[string(pkiID)]; exists {\n\t\treturn nil\n\t}","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/gossip/identity/identity.go#L95-L131","documentation":"Put calls is.mcs.Expiration(identity) to determine when the certificate expires; this error is errors.Wrap around whatever failure the MessageCryptoService reported while classifying (parsing/extracting expiry of) the identity. It indicates the certificate could not be parsed or evaluated by the crypto layer, not a nil-input problem.","triggerScenarios":"Calling Put with a well-formed non-nil identity whose certificate the MCS cannot classify — corrupt/expired X.509 certs, certificates from a foreign MSP, or crypto material not initialized on the peer.","commonSituations":"Peer's MSP not configured correctly (missing/corrupt certs in MSP folder); messages signed with identities from an unrelated network; certificate format changes after cert rotation.","solutions":["Inspect the wrapped cause with errors.Cause/%+v to see the underlying MCS failure and fix the certificate (renew, re-enroll, or replace)","Verify the peer's MSP directory contains valid, complete crypto material","Ensure identities come from the same network/MSP the local peer trusts"],"exampleFix":"// before\nerr := mapper.Put(pkiID, identity) // wrapped classification error, cause hidden\n\n// after\nerr := mapper.Put(pkiID, identity)\nif err != nil {\n    logger.Warningf(\"identity rejected: %v\", err) // logs wrapped MCS cause\n    return\n}","handlingStrategy":"try-catch","validationCode":"// pre-check expiration via the same MCS before Put\nexp, err := mcs.Expiration(identity)\nif err != nil || exp.Before(time.Now()) {\n    return fmt.Errorf(\"identity not usable: %v\", err)\n}\nerr = mapper.Put(pkiID, identity)","typeGuard":null,"tryCatchPattern":"if err := mapper.Put(pkiID, identity); err != nil {\n    logger.Warningf(\"identity rejected by mapper: %+v\", err) // reveals wrapped MCS cause\n    return\n}","preventionTips":["Keep peer MSP crypto material complete and current","Use %+v / errors.Cause to surface the wrapped MCS error for diagnosis","Renew certificates before expiry and re-register identities","Ensure identities come from MSPs the local peer trusts"],"tags":["gossip","hyperledger-fabric","msp","crypto"],"backgroundTag":"certificate-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}