{"record":{"id":"5115da48ed05919c","repo":"hyperledger/fabric","slug":"invalid-certificate-der","errorCode":null,"errorMessage":"invalid certificate DER","messagePattern":"invalid certificate DER","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/comm.go","lineNumber":278,"sourceCode":"\t// Check if the stub needs activation.\n\tif stub.Active() {\n\t\treturn\n\t}\n\n\t// Activate the stub\n\tstub.Activate(c.createRemoteContext(stub, channel))\n}\n\n// createRemoteContext returns a function that creates a RemoteContext.\n// It is used as a parameter to Stub.Activate() in order to activate\n// a stub atomically.\nfunc (c *Comm) createRemoteContext(stub *Stub, channel string) func() (*RemoteContext, error) {\n\treturn func() (*RemoteContext, error) {\n\t\tcert, err := x509.ParseCertificate(stub.ServerTLSCert)\n\t\tif err != nil {\n\t\t\tpemString := string(pem.EncodeToMemory(&pem.Block{Bytes: stub.ServerTLSCert}))\n\t\t\tc.Logger.Errorf(\"Invalid DER for channel %s, endpoint %s, ID %d: %v\", channel, stub.Endpoint, stub.ID, pemString)\n\t\t\treturn nil, errors.Wrap(err, \"invalid certificate DER\")\n\t\t}\n\n\t\tc.Logger.Debug(\"Connecting to\", stub.RemoteNode, \"for channel\", channel)\n\n\t\tconn, err := c.Connections.Connection(stub.Endpoint, stub.ServerTLSCert)\n\t\tif err != nil {\n\t\t\tc.Logger.Warningf(\"Unable to obtain connection to %d(%s) (channel %s): %v\", stub.ID, stub.Endpoint, channel, err)\n\t\t\treturn nil, err\n\t\t}\n\n\t\tprobeConnection := func(conn *grpc.ClientConn) error {\n\t\t\tconnState := conn.GetState()\n\t\t\tif connState == connectivity.Connecting {\n\t\t\t\treturn errors.Errorf(\"connection to %d(%s) is in state %s\", stub.ID, stub.Endpoint, connState)\n\t\t\t}\n\t\t\treturn nil\n\t\t}\n","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/comm.go#L260-L296","documentation":"In Comm.createRemoteContext, the stub's ServerTLSCert bytes failed x509.ParseCertificate, meaning the stored certificate is not valid DER-encoded X.509 data. The error wraps the underlying parse error and logs the PEM-encoded bytes to aid diagnosis. This indicates corrupted or wrong-format TLS certificate data in the membership stub.","triggerScenarios":"Calling Comm.Remote/CreateRemoteContext for a stub whose ServerTLSCert was populated with non-DER bytes - e.g. a PEM block (with headers) stored raw, a truncated certificate, or a non-certificate value.","commonSituations":"Misconfigured TLS root/consenter certificates in orderer config (channel config contains PEM instead of DER, or vice versa); corrupted channel config block; certificate field filled from the wrong config key; hand-edited or tool-mangled config updates.","solutions":["Inspect the logged PEM output in the orderer log to see what bytes are actually stored; verify they decode to a valid certificate.","Re-check the channel config (orderer endpoints / consenter TLS certs) and ensure the correct DER certificate bytes are supplied.","Regenerate or re-export the node's TLS certificate and update the channel config via a config update transaction.","If using cryptogen/fabric-ca, re-issue certificates and redeploy, then restart the ordering service."],"exampleFix":"// before\nrawPEM, _ := os.ReadFile(\"server.crt\") // PEM text stored as-is\nstub.ServerTLSCert = rawPEM\n// after\nblock, _ := pem.Decode(rawPEM) // extract DER bytes\nif block == nil { return errors.New(\"no PEM block\") }\nstub.ServerTLSCert = block.Bytes","handlingStrategy":"validation","validationCode":"// Go: pre-validate the stub's TLS cert parses before triggering RemoteContext creation\nif _, err := x509.ParseCertificate(stub.ServerTLSCert); err != nil {\n    return fmt.Errorf(\"stub %d has invalid TLS cert DER: %w\", stub.ID, err)\n}","typeGuard":"func validCertDER(der []byte) bool {\n    _, err := x509.ParseCertificate(der)\n    return err == nil\n}","tryCatchPattern":"remoteCtx, err := comm.Remote(channel, id)\nif err != nil {\n    var parseErr error\n    if strings.Contains(err.Error(), \"invalid certificate DER\") {\n        // bad cert bytes in membership; reconfigure with correct cert\n        parseErr = comm.reconfigureWithValidCert(channel, id)\n        return parseErr\n    }\n    return err\n}","preventionTips":["Always store raw DER bytes (pem.Block.Bytes) in ServerTLSCert, not the full PEM text.","Validate all consenter TLS certs with x509.ParseCertificate during config update tooling.","Generate certificates with fabric-ca/cryptogen rather than editing files by hand.","Diff certificate bytes against the source PEM when populating channel config."],"tags":["fabric","orderer","tls","certificate","x509"],"backgroundTag":"invalid-certificate-der","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}