{"record":{"id":"4a5eb0911cf3c986","repo":"hyperledger/fabric","slug":"certificate-must-be-different-from-nil","errorCode":null,"errorMessage":"certificate must be different from nil","messagePattern":"certificate must be different from nil","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/cert.go","lineNumber":78,"sourceCode":"\tUniqueId           asn1.BitString   `asn1:\"optional,tag:1\"`\n\tSubjectUniqueId    asn1.BitString   `asn1:\"optional,tag:2\"`\n\tExtensions         []pkix.Extension `asn1:\"optional,explicit,tag:3\"`\n}\n\nfunc isECDSASignedCert(cert *x509.Certificate) bool {\n\treturn cert.SignatureAlgorithm == x509.ECDSAWithSHA1 ||\n\t\tcert.SignatureAlgorithm == x509.ECDSAWithSHA256 ||\n\t\tcert.SignatureAlgorithm == x509.ECDSAWithSHA384 ||\n\t\tcert.SignatureAlgorithm == x509.ECDSAWithSHA512\n}\n\n// sanitizeECDSASignedCert checks that the signatures signing a cert\n// is in low-S. This is checked against the public key of parentCert.\n// If the signature is not in low-S, then a new certificate is generated\n// that is equals to cert but the signature that is in low-S.\nfunc sanitizeECDSASignedCert(cert *x509.Certificate, parentCert *x509.Certificate) (*x509.Certificate, error) {\n\tif cert == nil {\n\t\treturn nil, errors.New(\"certificate must be different from nil\")\n\t}\n\tif parentCert == nil {\n\t\treturn nil, errors.New(\"parent certificate must be different from nil\")\n\t}\n\n\texpectedSig, err := utils.SignatureToLowS(parentCert.PublicKey.(*ecdsa.PublicKey), cert.Signature)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// if sig == cert.Signature, nothing needs to be done\n\tif bytes.Equal(cert.Signature, expectedSig) {\n\t\treturn cert, nil\n\t}\n\t// otherwise create a new certificate with the new signature\n\n\t// 1. Unmarshal cert.Raw to get an instance of certificate,\n\t//    the lower level interface that represent an x509 certificate","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/cert.go#L60-L96","documentation":"sanitizeECDSASignedCert guard: the certificate argument is nil. The function needs a real cert to re-sign its ECDSA signature in low-S form; a nil cert is invalid input (exercised by TestSanitizeCertInvalidInput).","triggerScenarios":"Thrown at msp/cert.go:78 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure callers pass a parsed, non-nil x509 certificate","Fix upstream parsing that yielded nil instead of an error"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}