{"record":{"id":"7a4c509ad7bdea17","repo":"hyperledger/fabric","slug":"keymaterial-not-found-in-signingidentityinfo","errorCode":null,"errorMessage":"KeyMaterial not found in SigningIdentityInfo","messagePattern":"KeyMaterial not found in SigningIdentityInfo","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":235,"sourceCode":"\nfunc (msp *bccspmsp) getSigningIdentityFromConf(sidInfo *m.SigningIdentityInfo) (SigningIdentity, error) {\n\tif sidInfo == nil {\n\t\treturn nil, errors.New(\"getIdentityFromBytes error: nil sidInfo\")\n\t}\n\n\t// Extract the public part of the identity\n\tidPub, pubKey, err := msp.getIdentityFromConf(sidInfo.PublicSigner)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Find the matching private key in the BCCSP keystore\n\tprivKey, err := msp.bccsp.GetKey(pubKey.SKI())\n\t// Less Secure: Attempt to import Private Key from KeyInfo, if BCCSP was not able to find the key\n\tif err != nil {\n\t\tmspLogger.Debugf(\"Could not find SKI [%s], trying KeyMaterial field: %+v\\n\", hex.EncodeToString(pubKey.SKI()), err)\n\t\tif sidInfo.PrivateSigner == nil || sidInfo.PrivateSigner.KeyMaterial == nil {\n\t\t\treturn nil, errors.New(\"KeyMaterial not found in SigningIdentityInfo\")\n\t\t}\n\n\t\tpemKey, _ := pem.Decode(sidInfo.PrivateSigner.KeyMaterial)\n\t\tif pemKey == nil {\n\t\t\treturn nil, errors.Errorf(\"%s: wrong PEM encoding\", sidInfo.PrivateSigner.KeyIdentifier)\n\t\t}\n\t\tprivKey, err = msp.bccsp.KeyImport(pemKey.Bytes, &bccsp.ECDSAPrivateKeyImportOpts{Temporary: true})\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithMessage(err, \"getIdentityFromBytes error: Failed to import EC private key\")\n\t\t}\n\t}\n\n\t// get the peer signer\n\tpeerSigner, err := signer.New(msp.bccsp, privKey)\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"getIdentityFromBytes error: Failed initializing bccspCryptoSigner\")\n\t}\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L217-L253","documentation":"After loading the public key, the MSP looks up the private key in the BCCSP keystore by SKI. If not found, it falls back to importing the key from SigningIdentityInfo.PrivateSigner.KeyMaterial; when that field is also nil, this error is returned. Effectively: the private key matching the signing certificate is available nowhere.","triggerScenarios":"MSP setup where the keystore lacks a key with the signing cert's SKI and PrivateSigner.KeyMaterial is nil (KeyInfo present but empty, or PrivateSigner nil).","commonSituations":"keystore/ directory emptied or not copied; key stored in an HSM/other BCCSP provider than the one configured; MSP directory shared from a machine whose software keystore held the key.","solutions":["Ensure keystore/ contains the private key matching signcerts (same SKI), or configure BCCSP to point at the keystore that has it","Set PrivateSigner.KeyMaterial to the PEM-encoded private key when not relying on the keystore","Verify SKI mismatch is not the issue — regenerate signcerts from the key if the cert was reissued"],"exampleFix":"// before\nPrivateSigner: &m.KeyInfo{KeyIdentifier: ski} // KeyMaterial nil, not in keystore\n// after\nPrivateSigner: &m.KeyInfo{KeyIdentifier: ski, KeyMaterial: keyPEMBytes}","handlingStrategy":"validation","validationCode":"info := conf.SigningIdentity\nif info.PrivateSigner == nil || len(info.PrivateSigner.KeyMaterial) == 0 {\n    // also confirm keystore has key matching cert SKI\n    if _, err := bccspInst.GetKey(pubSKI); err != nil {\n        return fmt.Errorf(\"private key neither in keystore nor KeyMaterial: %w\", err)\n    }\n}","typeGuard":"func hasRecoverablePrivKey(info *m.SigningIdentityInfo) bool {\n    return info != nil && info.PrivateSigner != nil && len(info.PrivateSigner.KeyMaterial) > 0\n}","tryCatchPattern":"if err := msp.Setup(conf); err != nil && strings.Contains(err.Error(), \"KeyMaterial not found\") {\n    return fmt.Errorf(\"restore keystore key or embed KeyMaterial: %w\", err)\n}","preventionTips":["Never distribute MSP dirs without keystore/ (or provision an HSM-backed BCCSP consistently)","Regenerate signcerts from the key whenever keys change to avoid SKI mismatch","Keep BCCSP provider configuration identical across environments sharing MSP material"],"tags":["msp","private-key","keystore","bccsp"],"backgroundTag":"private-key-not-found","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}