{"record":{"id":"5944d43826baae46","repo":"hyperledger/fabric","slug":"failed-connecting-to-s-v","errorCode":null,"errorMessage":"failed connecting to %s: %v","messagePattern":"failed connecting to (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/cmd/stub.go","lineNumber":82,"sourceCode":"\tcomm, err := comm.NewClient(conf.TLSConfig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tsigner, err := signer.NewSigner(conf.SignerConfig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ttimeout, cancel := context.WithTimeout(context.Background(), defaultTimeout)\n\tdefer cancel()\n\n\tdisc := discoveryclient.NewClient(comm.NewDialer(server), signer.Sign, 0)\n\n\tresp, err := disc.Send(timeout, req, &discovery.AuthInfo{\n\t\tClientIdentity:    signer.Creator,\n\t\tClientTlsCertHash: comm.TLSCertHash,\n\t})\n\tif err != nil {\n\t\treturn nil, errors.Errorf(\"failed connecting to %s: %v\", server, err)\n\t}\n\treturn &response{\n\t\tResponse: resp,\n\t}, nil\n}\n\n// RawStub is a stub that communicates with the discovery service\n// without any intermediary.\ntype RawStub struct{}\n\n// Send sends the request, and receives a response\nfunc (stub *RawStub) Send(server string, conf common.Config, req *discoveryclient.Request) (ServiceResponse, error) {\n\tcomm, err := comm.NewClient(conf.TLSConfig)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tsigner, err := signer.NewSigner(conf.SignerConfig)\n\tif err != nil {","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/discovery/cmd/stub.go#L64-L100","documentation":"The discovery client stub wraps the low-level gRPC failure of discovery.Service.Send into a single contextual error. The underlying %v contains the real cause (TLS handshake failure, connection refused, authentication rejection, deadline exceeded). It surfaces whenever the signed discovery request could not be delivered or processed by the peer.","triggerScenarios":"Peer unreachable or wrong port; TLS certificate hash mismatch (ClientTlsCertHash does not match peer TLS config); peer's discovery service rejects the auth info (stale enrollment cert); timeout elapsing before response.","commonSituations":"Discovery service not enabled on the target peer; connecting through a proxy that strips TLS; expired or rotated MSP certificates in the local context; firewall blocking the peer port in Docker/Kubernetes environments.","solutions":["Verify the peer address/port and that discovery service is enabled (CORE_PEER_DISCOVERY_ENABLED... / peer.discovery.enabled=true in network config)","Check TLS: ensure tlsCertHash matches and CA certs are trusted by the client context","Re-enroll or refresh the client identity if the peer rejected the signature/auth info","Increase the timeout and confirm network connectivity (nc/curl to the peer port)"],"exampleFix":"// before\nresp, err := disc.Send(0, req, authInfo) // zero timeout fails fast\n\n// after\nresp, err := disc.Send(5*time.Second, req, &discovery.AuthInfo{\n    ClientIdentity:    signer.Creator,\n    ClientTlsCertHash: comm.TLSCertHash,\n})\nif err != nil {\n    return fmt.Errorf(\"failed connecting to %s: %w\", server, err)\n}","handlingStrategy":"retry","validationCode":"// pre-check connectivity before Send\nconn, err := grpc.Dial(server, grpc.WithTransportCredentials(creds))\nif err != nil {\n    return fmt.Errorf(\"peer %s unreachable before discovery: %w\", server, err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"resp, err := stub.Send(timeout, req, authInfo)\nif err != nil {\n    var wrapped string = err.Error()\n    if strings.Contains(wrapped, \"deadline exceeded\") {\n        // retry with backoff\n    } else if strings.Contains(wrapped, \"certificate\") || strings.Contains(wrapped, \"tls\") {\n        // fix TLS config, do not retry\n    }\n    return fmt.Errorf(\"discovery to %s failed: %w\", server, err)\n}","preventionTips":["Use a non-zero timeout (e.g. 5s) and retry with backoff","Keep ClientTlsCertHash in sync with the peer's TLS cert","Verify discovery service is enabled on the target peer","Rotate enrollment certs before expiry","Test peer reachability with grpc health checks in CI"],"tags":["network","grpc","tls","discovery"],"backgroundTag":"connection-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}