{"record":{"id":"644d52b141dfaef5","repo":"hyperledger/fabric","slug":"chaincode-s-with-given-certificate-hash-v-belong","errorCode":null,"errorMessage":"Chaincode %s with given certificate hash %v belongs to a different chaincode","messagePattern":"Chaincode (.+?) with given certificate hash (.+?) belongs to a different chaincode","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/accesscontrol/access.go","lineNumber":90,"sourceCode":"\tccName := chaincodeID.Name\n\t// Obtain certificate from stream\n\thash := extractCertificateHashFromContext(stream.Context())\n\tif len(hash) == 0 {\n\t\terrMsg := fmt.Sprintf(\"TLS is active but chaincode %s didn't send certificate\", ccName)\n\t\tlogger.Warning(errMsg)\n\t\treturn errors.New(errMsg)\n\t}\n\t// Look it up in the mapper\n\tregisteredName := ac.mapper.lookup(certHash(hash))\n\tif registeredName == \"\" {\n\t\terrMsg := fmt.Sprintf(\"Chaincode %s with given certificate hash %v not found in registry\", ccName, hash)\n\t\tlogger.Warning(errMsg)\n\t\treturn errors.New(errMsg)\n\t}\n\tif registeredName != ccName {\n\t\terrMsg := fmt.Sprintf(\"Chaincode %s with given certificate hash %v belongs to a different chaincode\", ccName, hash)\n\t\tlogger.Warning(errMsg)\n\t\treturn errors.New(errMsg)\n\t}\n\n\tlogger.Debug(\"Chaincode\", ccName, \"'s authentication is authorized\")\n\treturn nil\n}\n","sourceCodeStart":72,"sourceCodeEnd":96,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/accesscontrol/access.go#L72-L96","documentation":"After resolving the certificate hash to a registered name, the Authenticator verifies that the chaincode name carried in the REGISTER message matches the name registered for that certificate. A mismatch (someone presenting a valid cert but claiming a different chaincode name) is rejected with this error to prevent identity spoofing between chaincode connections.","triggerScenarios":"ChaincodeMessage_REGISTER whose ChaincodeID.Name differs from the registeredName that the mapper resolved for the presented TLS certificate hash — e.g., a connection for chaincode A sending a REGISTER claiming name B.","commonSituations":"Two chaincodes swapped TLS certificates or shared a cert file; a client SDK or test harness connecting with the wrong CORE_CHAINCODE_ID_NAME; container reuse where a cert minted for one chaincode is mounted into another.","solutions":["Ensure CORE_CHAINCODE_ID_NAME in the chaincode container matches the name under which its TLS cert was registered/launched.","Give each chaincode its own TLS certificate; do not share cert/key files across chaincode containers.","Check launch scripts/K8s specs for copy-paste errors where cert files or chaincode names were swapped.","Restart both peer and chaincode after fixing the name/cert pairing so mappings are rebuilt cleanly."],"exampleFix":"// before: name mismatch on registration\nCORE_CHAINCODE_ID_NAME=wrongcc:1.0 (with cert minted for mycc)\n// after\nCORE_CHAINCODE_ID_NAME=mycc:1.0 (with the cert minted for mycc)","handlingStrategy":"validation","validationCode":"// ensure declared name matches the cert provisioned for it\nif chaincodeName != expectedNameForCert(certPath) {\n    return errors.New(\"chaincode name does not match provisioned TLS certificate\")\n}","typeGuard":"func nameMatchesCert(name, certPath string, known map[string]certHash) bool {\n    cert, err := readCertDER(certPath)\n    if err != nil { return false }\n    h := sha256.Sum256(cert)\n    return known[name] == certHash(h[:])\n}","tryCatchPattern":"if err := authenticator.authenticate(msg, stream); err != nil {\n    if strings.Contains(err.Error(), \"belongs to a different chaincode\") {\n        // fix CORE_CHAINCODE_ID_NAME / cert pairing and reconnect\n    }\n}","preventionTips":["Keep a 1:1 mapping of chaincode name to TLS certificate; never share certs across chaincodes","Set CORE_CHAINCODE_ID_NAME exactly to the name used at registration/launch","Review container orchestration specs for copy-pasted cert files between chaincodes"],"tags":["hyperledger-fabric","tls","chaincode","identity-mismatch","access-control"],"backgroundTag":"chaincode-name-cert-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}