{"record":{"id":"43cbc3f5788291b8","repo":"hyperledger/fabric","slug":"invalid-msp-instance","errorCode":null,"errorMessage":"Invalid msp instance","messagePattern":"Invalid msp instance","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":714,"sourceCode":"\t// If this identity is of this specific type,\n\t// this is how I can validate it given the\n\t// root of trust this MSP has\n\tcase *identity:\n\t\treturn msp.getCertificationChainForBCCSPIdentity(id)\n\tdefault:\n\t\treturn nil, errors.New(\"identity type not recognized\")\n\t}\n}\n\n// getCertificationChainForBCCSPIdentity returns the certification chain of the passed bccsp identity within this msp\nfunc (msp *bccspmsp) getCertificationChainForBCCSPIdentity(id *identity) ([]*x509.Certificate, error) {\n\tif id == nil {\n\t\treturn nil, errors.New(\"Invalid bccsp identity. Must be different from nil.\")\n\t}\n\n\t// we expect to have a valid VerifyOptions instance\n\tif msp.opts == nil {\n\t\treturn nil, errors.New(\"Invalid msp instance\")\n\t}\n\n\t// CAs cannot be directly used as identities..\n\tif id.cert.IsCA {\n\t\treturn nil, errors.New(\"An X509 certificate with Basic Constraint: \" +\n\t\t\t\"Certificate Authority equals true cannot be used as an identity\")\n\t}\n\n\treturn msp.getValidationChain(id.cert, false)\n}\n\nfunc (msp *bccspmsp) getUniqueValidationChain(cert *x509.Certificate, opts x509.VerifyOptions) ([]*x509.Certificate, error) {\n\t// ask golang to validate the cert for us based on the options that we've built at setup time\n\tif msp.opts == nil {\n\t\treturn nil, errors.New(\"the supplied identity has no verify options\")\n\t}\n\tvalidationChains, err := cert.Verify(opts)\n\tif err != nil {","sourceCodeStart":696,"sourceCodeEnd":732,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L696-L732","documentation":"The X509 MSP keeps x509.VerifyOptions (roots, intermediates, time window) built during setup; getCertificationChainForBCCSPIdentity needs msp.opts to verify the chain. This error means the MSP instance is not fully initialized — setup never ran or failed, leaving opts nil, so chain validation cannot proceed.","triggerScenarios":"Calling Validate or GetCertificationChain on a bccspmsp whose Setup was never called or failed (missing/invalid MSP config directory, no readable cacerts), leaving msp.opts nil.","commonSituations":"MSP directory missing cacerts/ so setup aborted before building VerifyOptions; constructing bccspmsp programmatically without calling Setup; MSP manager setup skipped in tests.","solutions":["Ensure the MSP config directory is complete (cacerts/ with at least one CA cert, config.yaml if NodeOUs used) and MSPManager.Setup completes without error before using the MSP.","Fix the construction path (NewBccspMsp + Setup with the correct BCCSP crypto provider) and re-initialize the peer/orderer.","Check peer/orderer startup logs for the earlier MSP setup error that left the MSP half-initialized, correct the config, and restart."],"exampleFix":"// before\n// msp := msp.NewBccspMsp(...)\n// // Setup never called; msp.opts == nil\n// msp.Validate(id) // -> Invalid msp instance\n// after\nmsp, err := msp.NewBccspMsp(v1, bccspMgr)\nif err != nil { return err }\nif err := msp.Setup(mspConfig); err != nil { return err } // builds opts and cert pools\nreturn msp.Validate(id)","handlingStrategy":"validation","validationCode":"// guard before using an MSP\nif msp == nil || msp.GetType() != msp.FABRIC {\n    return errors.New(\"MSP not initialized\")\n}\n// and check Setup succeeded at startup\nif err := mspManager.Setup(nil); err != nil {\n    return fmt.Errorf(\"MSP setup failed: %w\", err)\n}","typeGuard":"func isSetup(msp msp.MSP) bool {\n    return msp != nil && msp.GetType() == msp.FABRIC\n}","tryCatchPattern":"if err := msp.Validate(id); err != nil {\n    if err.Error() == \"Invalid msp instance\" {\n        return fmt.Errorf(\"MSP for %s was not set up; check startup MSP config: %w\", mspID, err)\n    }\n    return err\n}","preventionTips":["Always verify peer/orderer startup logs show MSP setup succeeded before serving requests.","Ensure every MSP directory contains cacerts/ with at least one valid CA certificate.","Call MSP Setup immediately after NewBccspMsp in programmatic construction.","Fail container startup on any MSP setup error rather than running with a half-initialized MSP."],"tags":["fabric","msp","initialization"],"backgroundTag":"msp-not-initialized","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}