{"record":{"id":"794b620adc36acb3","repo":"hyperledger/fabric","slug":"could-not-sign-the-proposal-response-payload-v","errorCode":null,"errorMessage":"could not sign the proposal response payload: %v","messagePattern":"could not sign the proposal response payload: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/handlers/endorsement/plugin/plugin.go","lineNumber":55,"sourceCode":"// Returns:\n// The Endorsement: A signature over the payload, and an identity that is used to verify the signature\n// The payload that was given as input (could be modified within this function)\n// Or error on failure\nfunc (e *DefaultEndorsement) Endorse(prpBytes []byte, sp *peer.SignedProposal) (*peer.Endorsement, []byte, error) {\n\tsigner, err := e.SigningIdentityForRequest(sp)\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"failed fetching signing identity: %v\", err)\n\t}\n\t// serialize the signing identity\n\tidentityBytes, err := signer.Serialize()\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"could not serialize the signing identity: %v\", err)\n\t}\n\n\t// sign the concatenation of the proposal response and the serialized endorser identity with this endorser's key\n\tsignature, err := signer.Sign(append(prpBytes, identityBytes...))\n\tif err != nil {\n\t\treturn nil, nil, fmt.Errorf(\"could not sign the proposal response payload: %v\", err)\n\t}\n\tendorsement := &peer.Endorsement{Signature: signature, Endorser: identityBytes}\n\treturn endorsement, prpBytes, nil\n}\n\n// Init injects dependencies into the instance of the Plugin\nfunc (e *DefaultEndorsement) Init(dependencies ...endorsement.Dependency) error {\n\tfor _, dep := range dependencies {\n\t\tsIDFetcher, isSigningIdentityFetcher := dep.(identities.SigningIdentityFetcher)\n\t\tif !isSigningIdentityFetcher {\n\t\t\tcontinue\n\t\t}\n\t\te.SigningIdentityFetcher = sIDFetcher\n\t\treturn nil\n\t}\n\treturn errors.New(\"could not find SigningIdentityFetcher in dependencies\")\n}\n","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/endorsement/plugin/plugin.go#L37-L73","documentation":"The pluggable endorsement DefaultEndorsement.Endorse signs prpBytes concatenated with the serialized identity using signer.Sign. This error wraps a BCCSP signing failure, meaning no ECDSA signature could be produced for the endorsement.","triggerScenarios":"Endorse (via EndorseWithPlugin or TestEndorsementPlugin) calls signer.Sign(append(prpBytes, identityBytes...)) and the crypto provider returns an error — private key unavailable, keystore IO error, or HSM failure.","commonSituations":"Keystore *_sk file missing or unreadable by the plugin host process; PKCS#11 token login failure due to wrong pin/slot in BCCSP config; key object deleted from HSM between fetch and sign in long-running tests.","solutions":["Read the wrapped error to identify keystore vs HSM vs key-format cause","Restore the private key matching the signer certificate in the local MSP keystore with correct permissions","Verify BCCSP configuration (security, pkcs11 library/label/pin) against the deployed HSM","Rebuild/restart the peer or test harness so a fresh signer is obtained"],"exampleFix":"// before: HSM pin rotated, sign fails\n//   could not sign the proposal response payload: pkcs11: login failed\n// after: update BCCSP config and restart\n// core.yaml\npeer:\n  BCCSP:\n    PKCS11:\n      Pin: <new-pin>\n// docker restart peer0.org1.example.com","handlingStrategy":"try-catch","validationCode":"// pre-flight: ensure keystore key exists and matches signer cert\nif err := verifyKeyCertMatch(mspPath); err != nil {\n    return fmt.Errorf(\"key/cert mismatch, signing will fail: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"sig, err := signer.Sign(append(prpBytes, identityBytes...))\nif err != nil {\n    logger.Errorf(\"plugin signing failed (BCCSP/HSM?): %v\", err)\n    return nil, fmt.Errorf(\"endorsement aborted: %w\", err)\n}","preventionTips":["Monitor PKCS#11 token availability with periodic sign self-tests","Align BCCSP pin/slot config with HSM rotations","Protect keystore file permissions and backups","Restart peers after any crypto material change"],"tags":["fabric","endorsement-plugin","signing","bccsp","hsm"],"backgroundTag":"signing-operation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}