{"record":{"id":"71e52ed180ee092f","repo":"hyperledger/fabric","slug":"identity-s-for-msp-s-has-a-non-canonical-signatu","errorCode":null,"errorMessage":"identity %s for MSP %s has a non canonical signature","messagePattern":"identity (.+?) for MSP (.+?) has a non canonical signature","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":991,"sourceCode":"\t\treturn nil\n\t}\n\n\treturn isIdentitySignedInCanonicalForm(cert.Signature, identity.Mspid, identity.IdBytes)\n}\n\nfunc isIdentitySignedInCanonicalForm(sig []byte, mspID string, pemEncodedIdentity []byte) error {\n\tr, s, err := utils.UnmarshalECDSASignature(sig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\texpectedSig, err := utils.MarshalECDSASignature(r, s)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif !bytes.Equal(expectedSig, sig) {\n\t\treturn errors.Errorf(\"identity %s for MSP %s has a non canonical signature\",\n\t\t\tstring(pemEncodedIdentity), mspID)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":973,"sourceCodeEnd":997,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L973-L997","documentation":"Fabric requires ECDSA signatures in the canonical low-S ASN.1 form produced by utils.MarshalECDSASignature. isIdentitySignedInCanonicalForm re-encodes the identity certificate's signature (r,s) and compares to the original bytes; a mismatch means the signature uses high-S or non-standard DER encoding, which could yield differing identity hashes across crypto libraries, so it is rejected.","triggerScenarios":"IsWellFormed calls isIdentitySignedInCanonicalForm, which fails when the ECDSA signature on the identity certificate is not in the canonical low-S DER encoding — typically a certificate produced by non-Fabric tooling or an unusual CA.","commonSituations":"Importing certificates generated by OpenSSL/other CAs with high-S signatures into a Fabric MSP; older crypto libraries emitting non-canonical DER; crypto material copied from a non-Hyperledger CA.","solutions":["Re-issue/re-enroll the certificate with the Fabric CA (fabric-ca-client) so the signature is canonical","Re-sign the certificate with an ECDSA CA configured to produce low-S signatures (Go crypto does this by default)","Convert the offending cert by re-issuing from the same key via the fabric CA — the signature bytes cannot be safely patched by hand","If it is a CA certificate issue, regenerate the CA with cryptogen/fabric-ca and redistribute the chain"],"exampleFix":"// before\n// cert signed by custom OpenSSL CA with high-S ECDSA signature\n// after\nfabric-ca-client enroll -u http://ca:7054 -M msp  # re-enroll, canonical sig\n","handlingStrategy":"validation","validationCode":"// reject certs whose ECDSA signature is not low-S before enrollment\nsig := cert.Signature\n// verify signature parses and has S in lower half of order via crypto/ecdsa + math/big\nif new(big.Int).Cmp(s, new(big.Int).Rsh(curveN, 1)) > 0 { return errors.New(\"high-S signature\") }","typeGuard":null,"tryCatchPattern":"if err := msp.IsWellFormed(si); err != nil {\n\tif strings.Contains(err.Error(), \"non canonical signature\") {\n\t\t// re-issue cert with fabric-ca (Go crypto emits low-S)\n\t}\n\treturn err\n}","preventionTips":["Issue all identity certificates with fabric-ca or Go-based CAs that enforce low-S","Avoid importing certs from OpenSSL/other toolchains without re-issuance","Verify signature canonicality during onboarding of external crypto material"],"tags":["ecdsa","x509","fabric","signature"],"backgroundTag":"non-canonical-ecdsa-signature","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}