{"record":{"id":"790d9fc75ff7ebd2","repo":"hyperledger/fabric","slug":"failed-computing-validation-chain-for-v-s","errorCode":null,"errorMessage":"Failed computing validation chain for [%v]. [%s]","messagePattern":"Failed computing validation chain for \\[(.+?)\\]\\. \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplsetup.go","lineNumber":69,"sourceCode":"\t\t\t\tfound = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t}\n\tif !found {\n\t\t// Certificate not valid, reject configuration\n\t\treturn nil, fmt.Errorf(\"Failed adding OU. Certificate [%v] not in root or intermediate certs.\", cert)\n\t}\n\n\t// 3. get the certification path for it\n\tvar certifiersIdentifier []byte\n\tvar chain []*x509.Certificate\n\tif root {\n\t\tchain = []*x509.Certificate{cert}\n\t} else {\n\t\tchain, err = msp.getValidationChain(cert, true)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"Failed computing validation chain for [%v]. [%s]\", cert, err)\n\t\t}\n\t}\n\n\t// 4. compute the hash of the certification path\n\tcertifiersIdentifier, err = msp.getCertificationChainIdentifierFromChain(chain)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed computing Certifiers Identifier for [%v]. [%s]\", certRaw, err)\n\t}\n\n\treturn certifiersIdentifier, nil\n}\n\nfunc (msp *bccspmsp) setupCrypto(conf *m.FabricMSPConfig) error {\n\tmsp.cryptoConfig = conf.CryptoConfig\n\tif msp.cryptoConfig == nil {\n\t\t// Move to defaults\n\t\tmsp.cryptoConfig = &m.FabricCryptoConfig{\n\t\t\tSignatureHashFamily:            bccsp.SHA2,","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L51-L87","documentation":"For intermediate-CA-issued certificates, getCertifiersIdentifier builds the validation chain with getValidationChain. If the chain cannot be computed (missing issuer cert, expired CA, verification failure), setup fails with this wrapped error.","triggerScenarios":"getValidationChain(cert, true) returns an error during setupNodeOUs/setupOUs because the intermediate certificate's issuer (root CA) is not available/valid in the MSP, or chain verification fails.","commonSituations":"Intermediate CA present in intermediatecerts but its root missing from cacerts; expired or not-yet-valid CA certificates; intermediate signed by a root not in the MSP config; corrupted chain after partial MSP directory copy.","solutions":["Add the root CA certificate of the intermediate to the MSP cacerts directory","Check CA validity windows (notBefore/notAfter) with openssl x509 -dates","Re-copy the full MSP directory so intermediatecerts and cacerts are consistent","Re-issue the intermediate/leaf chain from the CA"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"roots := x509.NewCertPool()\nfor _, r := range rootPEMs { roots.AddCert(r) }\nif _, err := leafCert.Verify(x509.VerifyOptions{Roots: roots,\n    Intermediates: interPool, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}}); err != nil {\n    return fmt.Errorf(\"chain will not validate: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ship complete chains: root + intermediate in the MSP directory","Check CA expiry dates as part of operational monitoring","Validate chains locally with openssl verify -CAfile cacerts.pem intermediate.pem"],"tags":["x509","certificate-chain","msp-setup","hyperledger-fabric"],"backgroundTag":"certificate-chain-validation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}