{"record":{"id":"5096770113590631","repo":"hyperledger/fabric","slug":"unmarshalling-of-the-certificate-failed","errorCode":null,"errorMessage":"unmarshalling of the certificate failed","messagePattern":"unmarshalling of the certificate failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/cert.go","lineNumber":122,"sourceCode":"\t// 2. Change the signature\n\tnewCert.SignatureValue = asn1.BitString{Bytes: expectedSig, BitLength: len(expectedSig) * 8}\n\tnewCert.Raw = nil\n\n\t// 3. marshal again newCert. Raw must be nil\n\tnewRaw, err := asn1.Marshal(newCert)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"marshalling of the certificate failed\")\n\t}\n\n\t// 4. parse newRaw to get an x509 certificate\n\treturn x509.ParseCertificate(newRaw)\n}\n\nfunc certFromX509Cert(cert *x509.Certificate) (certificate, error) {\n\tvar newCert certificate\n\t_, err := asn1.Unmarshal(cert.Raw, &newCert)\n\tif err != nil {\n\t\treturn certificate{}, errors.Wrap(err, \"unmarshalling of the certificate failed\")\n\t}\n\treturn newCert, nil\n}\n\n// String returns a PEM representation of a certificate\nfunc (c certificate) String() string {\n\tb, err := asn1.Marshal(c)\n\tif err != nil {\n\t\treturn fmt.Sprintf(\"Failed marshaling cert: %v\", err)\n\t}\n\tblock := &pem.Block{\n\t\tBytes: b,\n\t\tType:  \"CERTIFICATE\",\n\t}\n\tb = pem.EncodeToMemory(block)\n\treturn string(b)\n}\n","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/cert.go#L104-L140","documentation":"certFromX509Cert re-parses a certificate's raw DER bytes with encoding/asn1 into Fabric's internal certificate struct. This error means the DER bytes could not be unmarshalled into the expected ASN.1 certificate structure, so the certificate is malformed or uses an encoding Fabric's struct does not model. It is wrapped around the underlying asn1 error.","triggerScenarios":"Calling sanitizeECDSASignedCert, certToPEM, or any code path (e.g. MSP setup, identity validation) that hands a *x509.Certificate whose Raw bytes do not decode as a standard Certificate ASN.1 sequence into certFromX509Cert.","commonSituations":"Corrupted or truncated certificate files in an MSP directory; certificates re-encoded by intermediary tools; exotic or non-standard extensions; hand-crafted test certs; certificates pulled from a non-X.509 source.","solutions":["Replace the malformed certificate file in the MSP directory with a valid PEM cert generated via openssl or cryptogen","Run 'openssl x509 -in cert.pem -text -noout' on each cert to find the one that fails to parse","Re-generate the MSP material with cryptogen or the Fabric CA instead of hand-editing DER bytes","Check whether an intermediate tool (e.g. an editor or base64 conversion) corrupted the file"],"exampleFix":"// before: hand-copied/truncated cert bytes loaded into MSP\ncert, _ := x509.ParseCertificate(rawBytes)\nnewCert, err := certFromX509Cert(cert) // fails\n// after: load a freshly generated, intact PEM cert\npemBytes, _ := os.ReadFile(\"cacerts/ca-cert.pem\")\nblock, _ := pem.Decode(pemBytes)\nx509Cert, _ := x509.ParseCertificate(block.Bytes)\nnewCert, err := certFromX509Cert(x509Cert)","handlingStrategy":"validation","validationCode":"func validateX509Cert(cert *x509.Certificate) error {\n    if cert == nil || len(cert.Raw) == 0 {\n        return fmt.Errorf(\"certificate has no raw DER content\")\n    }\n    var probe certificate\n    if _, err := asn1.Unmarshal(cert.Raw, &probe); err != nil {\n        return fmt.Errorf(\"cert not decodable as fabric certificate: %w\", err)\n    }\n    return nil\n}","typeGuard":"func isWellFormedCert(cert *x509.Certificate) bool {\n    var probe certificate\n    ok, err := asn1.Unmarshal(cert.Raw, &probe)\n    return err == nil && ok != nil\n}","tryCatchPattern":"if err != nil { var asnErr *asn1.StructuralError\n    if errors.As(err, &asnErr) { log.Fatalf(\"malformed certificate (ASN.1): %v\", err) }\n    return fmt.Errorf(\"load cert: %w\", err) }","preventionTips":["Only load certificates generated by cryptogen or fabric-ca","Validate every cert with 'openssl x509 -text -noout' before deploying","Never copy-paste or hand-edit PEM/DER material","Checksum MSP files after copying between environments"],"tags":["x509","asn1","certificate","parsing"],"backgroundTag":"certificate-parsing-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}