{"record":{"id":"49647d5e8ff5c498","repo":"hyperledger/fabric","slug":"failed-adding-ou-certificate-v-not-in-root-or","errorCode":null,"errorMessage":"Failed adding OU. Certificate [%v] not in root or intermediate certs.","messagePattern":"Failed adding OU\\. Certificate \\[(.+?)\\] not in root or intermediate certs\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplsetup.go","lineNumber":58,"sourceCode":"\tfor _, v := range msp.rootCerts {\n\t\tif v.(*identity).cert.Equal(cert) {\n\t\t\tfound = true\n\t\t\troot = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !found {\n\t\t// Search among root intermediate certificates\n\t\tfor _, v := range msp.intermediateCerts {\n\t\t\tif v.(*identity).cert.Equal(cert) {\n\t\t\t\tfound = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\tif !found {\n\t\t// Certificate not valid, reject configuration\n\t\treturn nil, fmt.Errorf(\"Failed adding OU. Certificate [%v] not in root or intermediate certs.\", cert)\n\t}\n\n\t// 3. get the certification path for it\n\tvar certifiersIdentifier []byte\n\tvar chain []*x509.Certificate\n\tif root {\n\t\tchain = []*x509.Certificate{cert}\n\t} else {\n\t\tchain, err = msp.getValidationChain(cert, true)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Failed computing validation chain for [%v]. [%s]\", cert, err)\n\t\t}\n\t}\n\n\t// 4. compute the hash of the certification path\n\tcertifiersIdentifier, err = msp.getCertificationChainIdentifierFromChain(chain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed computing Certifiers Identifier for [%v]. [%s]\", certRaw, err)","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L40-L76","documentation":"getCertifiersIdentifier requires that the certificate being classified appear among the MSP's rootCerts or intermediateCerts. If the certificate is found in neither list after comparison, the configuration is rejected because OU classification cannot be traced to a trusted CA.","triggerScenarios":"setupNodeOUs or setupOUs is given an OU identifier certificate (certifiers identifier computation) whose certificate is not registered in the MSP's root or intermediate CA lists — e.g. FabricNodeOus.*OuIdentifier.Certificate refers to a CA not in rootCerts/intermediateCerts.","commonSituations":"FabricNodeOus config entries (client/peer/admin/orderer OU) referencing a certificate from a different CA; copying NodeOUs config from one org to another without updating certs; root cert rotated but OU identifier cert left stale.","solutions":["Ensure each FabricNodeOus OU identifier certificate matches a cert listed in the MSP's rootCerts or intermediateCerts","Regenerate the NodeOUs config (configtxgen / fabric-ca) so identifiers align with the org's CA certificates","Update the OU identifier certificates after CA rotation","Verify the MSP directory contents (cacerts/intermediatecerts) match the channel config"],"exampleFix":"// before: FabricNodeOus.ClientOuIdentifier.Certificate from foreign CA\n// after: certificate equal to one in rootCerts/intermediateCerts of this MSP\nnull","handlingStrategy":"validation","validationCode":"// before setup, ensure every NodeOU identifier cert is in root/intermediate set\nfor _, ou := range conf.FabricNodeOus.OUIDentifiers() {\n    if !containsCert(rootCerts, ou.Certificate) && !containsCert(intermediateCerts, ou.Certificate) {\n        return fmt.Errorf(\"OU identifier cert not in CA lists\")\n    }\n}","typeGuard":"func certInList(certRaw []byte, list [][]byte) bool {\n    for _, c := range list {\n        if bytes.Equal(certRaw, c) { return true }\n    }\n    return false\n}","tryCatchPattern":null,"preventionTips":["Always regenerate NodeOUs identifiers from the same CA that issued root/intermediate certs","Update OU identifier certificates whenever CAs are rotated","Diff FabricNodeOus certificates against cacerts/intermediatecerts as part of deployment checks"],"tags":["msp-setup","nodeous","certificate-chain","hyperledger-fabric"],"backgroundTag":"certificate-not-in-trust-chain","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}