{"record":{"id":"765d414edc13aaf9","repo":"hyperledger/fabric","slug":"failed-generating-tls-binding-material","errorCode":null,"errorMessage":"failed generating TLS Binding material","messagePattern":"failed generating TLS Binding material","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/util.go","lineNumber":683,"sourceCode":"\tswitch t := request.GetPayload().(type) {\n\tcase *orderer.StepRequest_SubmitRequest:\n\t\tif t.SubmitRequest == nil || t.SubmitRequest.Payload == nil {\n\t\t\treturn fmt.Sprintf(\"Empty SubmitRequest: %v\", t.SubmitRequest)\n\t\t}\n\t\treturn fmt.Sprintf(\"SubmitRequest for channel %s with payload of size %d\",\n\t\t\tt.SubmitRequest.Channel, len(t.SubmitRequest.Payload.Payload))\n\tcase *orderer.StepRequest_ConsensusRequest:\n\t\treturn fmt.Sprintf(\"ConsensusRequest for channel %s with payload of size %d\",\n\t\t\tt.ConsensusRequest.Channel, len(t.ConsensusRequest.Payload))\n\tdefault:\n\t\treturn fmt.Sprintf(\"unknown type: %v\", request)\n\t}\n}\n\nfunc exportKM(cs tls.ConnectionState, label string, context []byte) ([]byte, error) {\n\ttlsBinding, err := cs.ExportKeyingMaterial(label, context, 32)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed generating TLS Binding material\")\n\t}\n\treturn tlsBinding, nil\n}\n\nfunc GetSessionBindingHash(authReq *orderer.NodeAuthRequest) []byte {\n\treturn util.ComputeSHA256(util.ConcatenateBytes(\n\t\t[]byte(strconv.FormatUint(uint64(authReq.Version), 10)),\n\t\tEncodeTimestamp(authReq.Timestamp),\n\t\t[]byte(strconv.FormatUint(authReq.FromId, 10)),\n\t\t[]byte(strconv.FormatUint(authReq.ToId, 10)),\n\t\t[]byte(authReq.Channel),\n\t))\n}\n\nfunc GetTLSSessionBinding(ctx context.Context, bindingPayload []byte) ([]byte, error) {\n\tpeerInfo, ok := peer.FromContext(ctx)\n\tif !ok {\n\t\treturn nil, errors.New(\"failed extracting stream context\")","sourceCodeStart":665,"sourceCodeEnd":701,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/util.go#L665-L701","documentation":"exportKM wraps tls.ConnectionState.ExportKeyingMaterial, used to build the TLS binding between a client and the ordering service. If the TLS stack cannot export keying material (most commonly because the connection's TLS session does not permit it — e.g. session resumption, TLS 1.3 exporter semantics, or a non-TLS connection), this wrapped error is returned.","triggerScenarios":"Calling exportKM (via the cluster mutual-TLS authentication path) when cs.ExportKeyingMaterial(label, context, 32) errors — typically on connections resumed via TLS session tickets, TLS versions/handshakes that disable exporters, or cipher suites without extended master secret.","commonSituations":"Orderer-client connections established through TLS-terminating proxies or load balancers (the orderer sees a resumed/re-terminated session), older TLS configurations without the extended-master-secret extension, misaligned TLS 1.3 usage between nodes.","solutions":["Ensure the connection is end-to-end TLS to the orderer — no TLS termination at a proxy/load balancer in front of the ordering port.","Disable TLS session resumption/tickets or require the extended master secret extension so keying material can be exported.","Align TLS versions/cipher suites in the orderer TLS config with the peers/clients (prefer TLS 1.2+ with EMS-supporting suites).","Check the wrapped cause for the exact TLS-layer reason and adjust tls.Config accordingly."],"exampleFix":"// before: TLS terminated at proxy -> orderer sees no exportable session\n// after: pass TLS through, or in tls.Config disable resumption\n// tlsConfig := &tls.Config{ SessionTicketsDisabled: true, MinVersion: tls.VersionTLS12 }","handlingStrategy":"validation","validationCode":"// Ensure TLS version supports exporters and EMS before binding\nif cs.Version < tls.VersionTLS12 {\n    return errors.New(\"TLS binding requires TLS 1.2 or higher with EMS\")\n}","typeGuard":null,"tryCatchPattern":"binding, err := exportKM(cs, label, context)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed generating TLS Binding material\") {\n        // re-establish a fresh (non-resumed) TLS connection and retry once\n        conn = redialFreshTLS(addr, tlsConfig)\n        return exportKM(conn.ConnectionState(), label, context)\n    }\n    return err\n}","preventionTips":["Never terminate TLS at a proxy in front of ordering service ports.","Disable TLS session tickets/resumption where exporter APIs are needed.","Pin TLS 1.2+ cipher suites supporting extended master secret across the network."],"tags":["fabric","tls","mutual-tls","orderer"],"backgroundTag":"tls-keying-material-export-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}