{"record":{"id":"447bba4a9229620a","repo":"hyperledger/fabric","slug":"ca-certificate-did-not-have-the-ca-attribute-sn","errorCode":null,"errorMessage":"CA Certificate did not have the CA attribute, (SN: %x)","messagePattern":"CA Certificate did not have the CA attribute, \\(SN: %x\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"msp/mspimplsetup.go","lineNumber":255,"sourceCode":"\t\t\tcrl.SignatureValue = asn1.BitString{Bytes: sig, BitLength: 8 * len(sig)}\n\t\t}\n\n\t\t// TODO: pre-verify the signature on the CRL and create a map\n\t\t//       of CA certs to respective CRLs so that later upon\n\t\t//       validation we can already look up the CRL given the\n\t\t//       chain of the certificate to be validated\n\n\t\tmsp.CRL[i] = crl\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) finalizeSetupCAs() error {\n\t// ensure that our CAs are properly formed and that they are valid\n\tfor _, id := range append(append([]Identity{}, msp.rootCerts...), msp.intermediateCerts...) {\n\t\tif !id.(*identity).cert.IsCA {\n\t\t\treturn errors.Errorf(\"CA Certificate did not have the CA attribute, (SN: %x)\", id.(*identity).cert.SerialNumber)\n\t\t}\n\t\tif _, err := getSubjectKeyIdentifierFromCert(id.(*identity).cert); err != nil {\n\t\t\treturn errors.WithMessagef(err, \"CA Certificate problem with Subject Key Identifier extension, (SN: %x)\", id.(*identity).cert.SerialNumber)\n\t\t}\n\n\t\tif err := msp.validateCAIdentity(id.(*identity)); err != nil {\n\t\t\treturn errors.WithMessagef(err, \"CA Certificate is not valid, (SN: %s)\", id.(*identity).cert.SerialNumber)\n\t\t}\n\t}\n\n\t// populate certificationTreeInternalNodesMap to mark the internal nodes of the\n\t// certification tree\n\tmsp.certificationTreeInternalNodesMap = make(map[string]bool)\n\tfor _, id := range append([]Identity{}, msp.intermediateCerts...) {\n\t\tchain, err := msp.getUniqueValidationChain(id.(*identity).cert, msp.getValidityOptsForCert(id.(*identity).cert))\n\t\tif err != nil {\n\t\t\treturn errors.WithMessagef(err, \"failed getting validation chain, (SN: %s)\", id.(*identity).cert.SerialNumber)\n\t\t}","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L237-L273","documentation":"finalizeSetupCAs validates that every root and intermediate CA identity's certificate has the BasicConstraints CA flag set (cert.IsCA). A certificate in cacerts/ or intermediatecerts/ without CA:true is rejected because it cannot properly sign or validate chains.","triggerScenarios":"A certificate placed in the MSP's cacerts or intermediatecerts (loaded via setupCAs into rootCerts/intermediateCerts, sanitized, then finalized) has IsCA=false — i.e., an end-entity certificate used as a CA.","commonSituations":"Copying an admin/client certificate into cacerts by mistake; generating a CA without the CA basic constraint extension; a misconfigured fabric-ca or openssl CSR where basicConstraints CA:true was omitted; TestMalformedCertsChainSetup exercising this path in tests.","solutions":["Replace the certificate in cacerts/intermediatecerts with a real CA certificate that has basicConstraints CA:TRUE","Re-generate the CA with openssl req -x509 (which sets CA:true) or fabric-ca-server init","Check with: openssl x509 -in cert.pem -text | grep -A1 'Basic Constraints'","If intending an intermediate CA, issue it from the root with CA:TRUE extension"],"exampleFix":"// before: leaf cert (CA:FALSE) in msp/cacerts/\n// after: proper CA cert\n//   openssl req -x509 -new -nodes -key ca.key -sha256 -days 365 \\\n//     -subj '/CN=Org1 CA' -addext 'basicConstraints=critical,CA:TRUE' -out ca.crt\nnull","handlingStrategy":"validation","validationCode":"for _, c := range caCerts {\n    if !c.IsCA {\n        return fmt.Errorf(\"cert %s lacks CA basic constraint\", c.Subject)\n    }\n    if c.KeyUsage&x509.KeyUsageCertSign == 0 {\n        return fmt.Errorf(\"cert %s lacks certSign key usage\", c.Subject)\n    }\n}","typeGuard":"func isCACert(c *x509.Certificate) bool {\n    return c.IsCA && c.KeyUsage&x509.KeyUsageCertSign != 0\n}","tryCatchPattern":null,"preventionTips":["Verify basicConstraints CA:TRUE on every cert placed in cacerts/intermediatecerts","Never copy admin/client certs into CA directories","Generate CAs with -x509 self-signed issuance that includes CA constraints"],"tags":["x509","ca-certificate","certificate-extensions","hyperledger-fabric"],"backgroundTag":"certificate-missing-ca-extension","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}