{"record":{"id":"53f9854a608f06c1","repo":"hyperledger/fabric","slug":"could-not-serialize-the-signing-identity","errorCode":null,"errorMessage":"could not serialize the signing identity","messagePattern":"could not serialize the signing identity","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/handlers/endorsement/builtin/default_endorsement.go","lineNumber":43,"sourceCode":"// DefaultEndorsement is an endorsement plugin that behaves as the default endorsement system chaincode\ntype DefaultEndorsement struct {\n\tidentities.SigningIdentityFetcher\n}\n\n// Endorse signs the given payload(ProposalResponsePayload bytes), and optionally mutates it.\n// Returns:\n// The Endorsement: A signature over the payload, and an identity that is used to verify the signature\n// The payload that was given as input (could be modified within this function)\n// Or error on failure\nfunc (e *DefaultEndorsement) Endorse(prpBytes []byte, sp *peer.SignedProposal) (*peer.Endorsement, []byte, error) {\n\tsigner, err := e.SigningIdentityForRequest(sp)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"failed fetching signing identity\")\n\t}\n\t// serialize the signing identity\n\tidentityBytes, err := signer.Serialize()\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrapf(err, \"could not serialize the signing identity\")\n\t}\n\n\t// sign the concatenation of the proposal response and the serialized endorser identity with this endorser's key\n\tsignature, err := signer.Sign(append(prpBytes, identityBytes...))\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrapf(err, \"could not sign the proposal response payload\")\n\t}\n\tendorsement := &peer.Endorsement{Signature: signature, Endorser: identityBytes}\n\treturn endorsement, prpBytes, nil\n}\n\n// Init injects dependencies into the instance of the Plugin\nfunc (e *DefaultEndorsement) Init(dependencies ...endorsement.Dependency) error {\n\tfor _, dep := range dependencies {\n\t\tsIDFetcher, isSigningIdentityFetcher := dep.(identities.SigningIdentityFetcher)\n\t\tif !isSigningIdentityFetcher {\n\t\t\tcontinue\n\t\t}","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/endorsement/builtin/default_endorsement.go#L25-L61","documentation":"In Fabric's default endorsement plugin, after the signing identity for the proposal is fetched, it must be serialized into bytes (the endorser's certificate chain) to be embedded in the endorsement. This error wraps the failure of signer.Serialize(), meaning the local MSP membership provider could not produce a serialized identity for this peer's signer.","triggerScenarios":"Calling Endorse on the builtin default endorsement plugin (DefaultEndorsement.Endorse) when signer.Serialize() fails — typically because the peer's local MSP identity material is missing, malformed, or the crypto material cannot be marshaled into the MSProtobuf identity form.","commonSituations":"Peer started with a corrupted or incomplete mspConfigPath/adminCerts configuration; crypto material regenerated by 'cryptogen' or an HSM after the peer cached it; expired or mismatched certificates in the local MSP folder; hardware security module (PKCS#11) keystore errors during identity export.","solutions":["Verify the peer's local MSP directory (core.yaml: peer.mspConfigPath) contains valid signcerts, keystore, and cacerts and restart the peer","Regenerate the crypto material for this peer's organization and redeploy the peer","Check crypto library configuration (BCCSP: SW vs PKCS#11) matches the keystore format actually on disk","Inspect the wrapped inner error in the peer log for the underlying serialization cause"],"exampleFix":"// before: peer launched with stale MSP after cert rotation\n//   ERROR ... could not serialize the signing identity: pem import failed\n// after: point peer at regenerated MSP and restart\n// core.yaml\npeer:\n  mspConfigPath: /var/hyperledger/msp/signcerts-regenerated\n// then: docker restart peer0.org1.example.com","handlingStrategy":"validation","validationCode":"signer, err := fetcher.SigningIdentityForRequest(sp)\nif err != nil { return err }\nif _, err := signer.Serialize(); err != nil {\n    return fmt.Errorf(\"peer signing identity not serializable: %w\", err)\n}","typeGuard":"func isSerializable(signer msp.SigningIdentity) bool {\n    _, err := signer.Serialize()\n    return err == nil\n}","tryCatchPattern":null,"preventionTips":["Keep peer local MSP (signcerts/keystore/cacerts) intact and owned by the peer process user","Regenerate crypto material with the same tooling versions used to deploy","Monitor BCCSP/PKCS#11 health when using HSMs","Verify MSP completeness at peer startup before serving endorsement requests"],"tags":["fabric","endorsement","msp","identity-serialization","crypto-material"],"backgroundTag":"msp-identity-serialization-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}