{"record":{"id":"47820f6cc01badf2","repo":"hyperledger/fabric","slug":"key-extraction-failed","errorCode":null,"errorMessage":"key extraction failed","messagePattern":"key extraction failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/util.go","lineNumber":721,"sourceCode":"\tconnState := peerInfo.AuthInfo.(credentials.TLSInfo).State\n\n\ttlsBinding, err := exportKM(connState, KeyingMaterialLabel, bindingPayload)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed exporting keying material\")\n\t}\n\n\treturn tlsBinding, nil\n}\n\nfunc VerifySignature(identity, msgHash, signature []byte) error {\n\tblock, _ := pem.Decode(identity)\n\tif block == nil {\n\t\treturn errors.New(\"pem decoding failed\")\n\t}\n\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"key extraction failed\")\n\t}\n\n\tpubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)\n\tif !isECDSA {\n\t\treturn errors.New(\"not valid public key\")\n\t}\n\n\tvalidSignature := ecdsa.VerifyASN1(pubKey, msgHash, signature)\n\n\tif !validSignature {\n\t\treturn errors.New(\"signature invalid\")\n\t}\n\treturn nil\n}\n\nfunc SHA256Digest(data []byte) []byte {\n\thash := sha256.Sum256(data)\n\treturn hash[:]","sourceCodeStart":703,"sourceCodeEnd":739,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/util.go#L703-L739","documentation":"After PEM decoding succeeds, VerifySignature parses the DER bytes as an X.509 certificate. x509.ParseCertificate failure is wrapped with this message, meaning the block existed but its payload is not a well-formed certificate.","triggerScenarios":"PEM block contains a non-certificate (private key, public key, CSR) so its DER payload fails certificate parsing; truncated or corrupted certificate bytes; an unrecognized extension marked critical that the local crypto/x509 rejects.","commonSituations":"Pointing config at a private-key PEM instead of the certificate; certificates generated with non-standard encodings; damaged files transferred via copy/paste or wrong mount.","solutions":["Confirm the PEM block type is CERTIFICATE (openssl x509 -in file -noout -text should succeed)","Replace the file with the correct certificate (not key or CSR)","Regenerate/re-export the certificate; avoid editing cert files manually (trailing whitespace/newline corruption)","Check the inner wrapped error for the specific ASN.1 parse problem (e.g. truncated, unknown critical extension)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"blk, _ := pem.Decode(identityPEM)\nif blk == nil { return errors.New(\"not PEM\") }\nif _, err := x509.ParseCertificate(blk.Bytes); err != nil {\n    return fmt.Errorf(\"identity PEM payload is not a valid certificate: %w\", err)\n}","typeGuard":"func isParseableCertPEM(data []byte) bool {\n    blk, _ := pem.Decode(data)\n    if blk == nil { return false }\n    _, err := x509.ParseCertificate(blk.Bytes)\n    return err == nil\n}","tryCatchPattern":"err := cluster.VerifySignature(identityPEM, hash, sig)\nif err != nil && strings.Contains(err.Error(), \"key extraction failed\") {\n    return fmt.Errorf(\"identity file is not a certificate (wrong file or corrupt): %w\", err)\n}","preventionTips":["Verify the PEM block type is CERTIFICATE, not PRIVATE KEY or CERTIFICATE REQUEST","Regenerate certificates that fail openssl x509 parsing","Avoid copy/paste transfers of cert files; use file copies","Pin the issuing CA and regenerate identities after algorithm changes"],"tags":["x509","certificate","crypto"],"backgroundTag":"certificate-parse-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}