{"record":{"id":"5f9732059f6750f7","repo":"hyperledger/fabric","slug":"parent-certificate-must-be-different-from-nil","errorCode":null,"errorMessage":"parent certificate must be different from nil","messagePattern":"parent certificate must be different from nil","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/cert.go","lineNumber":81,"sourceCode":"}\n\nfunc isECDSASignedCert(cert *x509.Certificate) bool {\n\treturn cert.SignatureAlgorithm == x509.ECDSAWithSHA1 ||\n\t\tcert.SignatureAlgorithm == x509.ECDSAWithSHA256 ||\n\t\tcert.SignatureAlgorithm == x509.ECDSAWithSHA384 ||\n\t\tcert.SignatureAlgorithm == x509.ECDSAWithSHA512\n}\n\n// sanitizeECDSASignedCert checks that the signatures signing a cert\n// is in low-S. This is checked against the public key of parentCert.\n// If the signature is not in low-S, then a new certificate is generated\n// that is equals to cert but the signature that is in low-S.\nfunc sanitizeECDSASignedCert(cert *x509.Certificate, parentCert *x509.Certificate) (*x509.Certificate, error) {\n\tif cert == nil {\n\t\treturn nil, errors.New(\"certificate must be different from nil\")\n\t}\n\tif parentCert == nil {\n\t\treturn nil, errors.New(\"parent certificate must be different from nil\")\n\t}\n\n\texpectedSig, err := utils.SignatureToLowS(parentCert.PublicKey.(*ecdsa.PublicKey), cert.Signature)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// if sig == cert.Signature, nothing needs to be done\n\tif bytes.Equal(cert.Signature, expectedSig) {\n\t\treturn cert, nil\n\t}\n\t// otherwise create a new certificate with the new signature\n\n\t// 1. Unmarshal cert.Raw to get an instance of certificate,\n\t//    the lower level interface that represent an x509 certificate\n\t//    encoding\n\tvar newCert certificate\n\tnewCert, err = certFromX509Cert(cert)","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/cert.go#L63-L99","documentation":"sanitizeECDSASignedCert guard: parentCert is nil. The parent's public key is required to verify and re-create the low-S signature, so a nil issuer certificate is rejected (exercised by TestSanitizeCertInvalidInput).","triggerScenarios":"Thrown at msp/cert.go:81 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide the issuing (parent) certificate when sanitizing","Fix certificate-chain loading so the parent is resolved"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}