{"record":{"id":"66789f2e371a9727","repo":"hyperledger/fabric","slug":"no-ca-certificate-found-in-directory-s","errorCode":null,"errorMessage":"no ca certificate found in directory %s","messagePattern":"no ca certificate found in directory (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/configbuilder.go","lineNumber":222,"sourceCode":"\tdefault:\n\t\treturn nil, errors.Errorf(\"unknown MSP type '%s'\", mspType)\n\t}\n}\n\nfunc getMspConfig(dir string, ID string, sigid *msp.SigningIdentityInfo) (*msp.MSPConfig, error) {\n\tcacertDir := filepath.Join(dir, cacerts)\n\tadmincertDir := filepath.Join(dir, admincerts)\n\tintermediatecertsDir := filepath.Join(dir, intermediatecerts)\n\tcrlsDir := filepath.Join(dir, crlsfolder)\n\tconfigFile := filepath.Join(dir, configfilename)\n\ttlscacertDir := filepath.Join(dir, tlscacerts)\n\ttlsintermediatecertsDir := filepath.Join(dir, tlsintermediatecerts)\n\n\tcacerts, err := getPemMaterialFromDir(cacertDir)\n\tif err != nil {\n\t\treturn nil, errors.WithMessagef(err, \"could not load a valid ca certificate from directory %s\", cacertDir)\n\t} else if len(cacerts) == 0 {\n\t\treturn nil, errors.Errorf(\"no ca certificate found in directory %s\", cacertDir)\n\t}\n\n\tadmincert, err := getPemMaterialFromDir(admincertDir)\n\tif err != nil && !os.IsNotExist(err) {\n\t\treturn nil, errors.WithMessagef(err, \"could not load a valid admin certificate from directory %s\", admincertDir)\n\t}\n\n\tintermediatecerts, err := getPemMaterialFromDir(intermediatecertsDir)\n\tif os.IsNotExist(err) {\n\t\tmspLogger.Debugf(\"Intermediate certs folder not found at [%s]. Skipping. [%s]\", intermediatecertsDir, err)\n\t} else if err != nil {\n\t\treturn nil, errors.WithMessagef(err, \"failed loading intermediate ca certs at [%s]\", intermediatecertsDir)\n\t}\n\n\ttlsCACerts, err := getPemMaterialFromDir(tlscacertDir)\n\ttlsIntermediateCerts := [][]byte{}\n\tif os.IsNotExist(err) {\n\t\tmspLogger.Debugf(\"TLS CA certs folder not found at [%s]. Skipping and ignoring TLS intermediate CA folder. [%s]\", tlsintermediatecertsDir, err)","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/configbuilder.go#L204-L240","documentation":"getMspConfig reads <msp-dir>/cacerts to build a verifying MSP; the MSP must trust at least one CA. This error means the cacerts directory was read successfully but contained no certificates, so the organization would trust nothing.","triggerScenarios":"Calling GetVerifyingMspConfig (via createMSP for channel/org config) or getMspConfig with an MSP directory whose cacerts/ folder is empty; also hit by GetLocalMspConfig callers when building the local config path.","commonSituations":"Org dir generated without cacerts, configtx.yaml pointing to a crypto dir missing the CA certs, MSP copied from another org leaving cacerts empty, certificates deleted during cleanup, container mount missing CA files.","solutions":["Copy the org's CA cert PEM into <msp-dir>/cacerts/ and retry","Regenerate crypto material with cryptogen or 'fabric-ca-client enroll' so cacerts is populated","Verify configtx.yaml / the dir argument points at the correct organization MSP directory","Confirm each cacerts file is a valid PEM: 'openssl x509 -in cacerts/*.pem -noout'"],"exampleFix":"// before: cacerts empty\n$ ls org1.example.com/msp/cacerts   # (empty)\n// after\n$ cp ca-certs/org1-ca.pem org1.example.com/msp/cacerts/\n$ ls org1.example.com/msp/cacerts   # org1-ca.pem","handlingStrategy":"validation","validationCode":"func hasCACert(orgMSP string) error {\n    certs, err := filepath.Glob(filepath.Join(orgMSP, \"cacerts\", \"*.pem\"))\n    if err != nil { return err }\n    if len(certs) == 0 {\n        return fmt.Errorf(\"%s/cacerts empty: copy the org CA cert PEM\", orgMSP)\n    }\n    for _, c := range certs {\n        b, err := os.ReadFile(c)\n        if err != nil { return err }\n        if pem.Decode(b) == nil { return fmt.Errorf(\"%s not PEM\", c) }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := mspmgmt.GetVerifyingMspConfig(dir, \"Org1MSP\", \"fabric\"); err != nil {\n    if strings.Contains(err.Error(), \"no ca certificate found\") {\n        return fmt.Errorf(\"populate %s/cacerts with the org CA cert\", dir)\n    }\n    return err\n}","preventionTips":["Validate the full MSP layout (cacerts non-empty, PEM parseable) before configtx/genesis generation","Never delete or move files out of cacerts during cleanup","Point configtx.yaml organizations at the org's MSP dir, not the node's","Verify CA certs load with 'openssl x509 -in cacerts/*.pem -noout' in deployment scripts"],"tags":["msp","ca-certificate","configuration"],"backgroundTag":"missing-ca-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}