{"record":{"id":"47345e17472f54d4","repo":"hyperledger/fabric","slug":"only-ca-identities-can-be-validated","errorCode":null,"errorMessage":"Only CA identities can be validated","messagePattern":"Only CA identities can be validated","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":65,"sourceCode":"\tif err != nil {\n\t\tid.validationErr = errors.WithMessage(err, \"could not validate identity against certification chain\")\n\t\tmspLogger.Warnf(\"Could not validate identity: %s (certificate subject=%s issuer=%s serialnumber=%d)\", id.validationErr, id.cert.Subject, id.cert.Issuer, id.cert.SerialNumber)\n\t\treturn id.validationErr\n\t}\n\n\terr = msp.internalValidateIdentityOusFunc(id)\n\tif err != nil {\n\t\tid.validationErr = errors.WithMessage(err, \"could not validate identity's OUs\")\n\t\tmspLogger.Warnf(\"Could not validate identity: %s (certificate subject=%s issuer=%s serialnumber=%d)\", id.validationErr, id.cert.Subject, id.cert.Issuer, id.cert.SerialNumber)\n\t\treturn id.validationErr\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) validateCAIdentity(id *identity) error {\n\tif !id.cert.IsCA {\n\t\treturn errors.New(\"Only CA identities can be validated\")\n\t}\n\n\tvalidationChain, err := msp.getUniqueValidationChain(id.cert, msp.getValidityOptsForCert(id.cert))\n\tif err != nil {\n\t\treturn errors.WithMessage(err, \"could not obtain certification chain\")\n\t}\n\tif len(validationChain) == 1 {\n\t\t// validationChain[0] is the root CA certificate\n\t\treturn nil\n\t}\n\n\treturn msp.validateIdentityAgainstChain(id, validationChain)\n}\n\nfunc (msp *bccspmsp) validateTLSCAIdentity(cert *x509.Certificate, opts *x509.VerifyOptions) error {\n\tif !cert.IsCA {\n\t\treturn errors.New(\"Only CA identities can be validated\")\n\t}","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L47-L83","documentation":"validateCAIdentity guard: the certificate being validated in the CA path is not actually a CA certificate (its BasicConstraints do not mark it as a CA). Called from finalizeSetupCAs when validating trusted root/intermediate CA certs that were loaded into the MSP.","triggerScenarios":"Thrown at msp/mspimplvalidate.go:65 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Replace the offending certificate with one issued with the CA basic constraint set","Remove the non-CA certificate from the RootCAs/IntermediateCAs lists"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}