{"record":{"id":"5298c5ba3c41b2b9","repo":"hyperledger/fabric","slug":"chaincode-s-with-given-certificate-hash-v-not-fo","errorCode":null,"errorMessage":"Chaincode %s with given certificate hash %v not found in registry","messagePattern":"Chaincode (.+?) with given certificate hash (.+?) not found in registry","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/accesscontrol/access.go","lineNumber":85,"sourceCode":"\terr := proto.Unmarshal(msg.Payload, chaincodeID)\n\tif err != nil {\n\t\tlogger.Warning(\"Failed unmarshalling message:\", err)\n\t\treturn err\n\t}\n\tccName := chaincodeID.Name\n\t// Obtain certificate from stream\n\thash := extractCertificateHashFromContext(stream.Context())\n\tif len(hash) == 0 {\n\t\terrMsg := fmt.Sprintf(\"TLS is active but chaincode %s didn't send certificate\", ccName)\n\t\tlogger.Warning(errMsg)\n\t\treturn errors.New(errMsg)\n\t}\n\t// Look it up in the mapper\n\tregisteredName := ac.mapper.lookup(certHash(hash))\n\tif registeredName == \"\" {\n\t\terrMsg := fmt.Sprintf(\"Chaincode %s with given certificate hash %v not found in registry\", ccName, hash)\n\t\tlogger.Warning(errMsg)\n\t\treturn errors.New(errMsg)\n\t}\n\tif registeredName != ccName {\n\t\terrMsg := fmt.Sprintf(\"Chaincode %s with given certificate hash %v belongs to a different chaincode\", ccName, hash)\n\t\tlogger.Warning(errMsg)\n\t\treturn errors.New(errMsg)\n\t}\n\n\tlogger.Debug(\"Chaincode\", ccName, \"'s authentication is authorized\")\n\treturn nil\n}\n","sourceCodeStart":67,"sourceCodeEnd":96,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/accesscontrol/access.go#L67-L96","documentation":"During registration the peer extracts the client certificate hash and looks it up in the registry mapper that stores chaincode-name-to-certificate mappings. If the certificate is valid but not registered (lookup returns empty), the peer rejects the register message with 'Chaincode %s with given certificate hash %v not found in registry'.","triggerScenarios":"A chaincode sends ChaincodeMessage_REGISTER over a TLS connection whose client cert hash is not in the Authenticator's mapper — i.e., the peer never pre-registered this connection (registerHandler was not called for this chaincode name/cert pair) or the cert differs from the registered one.","commonSituations":"Chaincode restarted with a new TLS certificate while the peer still holds the old mapping; launching a second instance of the same chaincode name with a different cert; peer reboot losing in-memory mappings while chaincode connections persist; dev-mode quirks where the handler registry was not populated.","solutions":["Restart the chaincode and peer so the launch handler registers the certificate hash before the chaincode connects.","Ensure the chaincode uses the exact TLS certificate/key pair provisioned for its registered name (do not rotate certs without re-launching via the peer launch flow).","Avoid running duplicate chaincode containers with the same name but different certs; remove stale containers.","If in dev mode, use the peer chaincode launch path or re-register the connection instead of connecting ad hoc."],"exampleFix":"// before: cert rotated but peer mapper still has old hash\n# chaincode restarted with new tls.crt, peer unaware\n// after: re-register via peer launch so the new cert hash is mapped\npeer node restart # or delete stale chaincode container and let peer relaunch it","handlingStrategy":"retry","validationCode":"// confirm the cert hash the chaincode will present matches the one provisioned at launch\ncert, err := tls.LoadX509KeyPair(certPath, keyPath)\nif err != nil { return err }\nh := sha256.Sum256(cert.Certificate[0])\n_ = h // compare against the hash registered in the peer's mapper","typeGuard":"func certMatchesRegistered(certDER []byte, registeredHash certHash) bool {\n    h := sha256.Sum256(certDER)\n    return certHash(h[:]) == registeredHash\n}","tryCatchPattern":"if err := authenticator.authenticate(msg, stream); err != nil {\n    if strings.Contains(err.Error(), \"not found in registry\") {\n        // let the peer relaunch the chaincode to (re)register the cert, then reconnect\n    }\n}","preventionTips":["Launch chaincodes through the peer so cert hashes are registered before the first message","Do not rotate chaincode TLS certificates without restarting the peer/launch flow","Remove stale duplicate chaincode containers using the same name with different certs"],"tags":["hyperledger-fabric","tls","chaincode","registry","access-control"],"backgroundTag":"chaincode-cert-not-registered","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}