{"record":{"id":"7d1923930a5b9568","repo":"hyperledger/fabric","slug":"certifiersidentifier-does-not-match-v-msp-s","errorCode":null,"errorMessage":"certifiersIdentifier does not match: %v, MSP: [%s]","messagePattern":"certifiersIdentifier does not match: (.+?), MSP: \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":215,"sourceCode":"\t// Make sure that the identity has only one of the special OUs\n\t// used to tell apart clients or peers.\n\tcounter := 0\n\tfor _, OU := range id.GetOrganizationalUnits() {\n\t\t// Is OU.OrganizationalUnitIdentifier one of the special OUs?\n\t\tvar nodeOU *OUIdentifier\n\t\tswitch OU.OrganizationalUnitIdentifier {\n\t\tcase msp.clientOU.OrganizationalUnitIdentifier:\n\t\t\tnodeOU = msp.clientOU\n\t\tcase msp.peerOU.OrganizationalUnitIdentifier:\n\t\t\tnodeOU = msp.peerOU\n\t\tdefault:\n\t\t\tcontinue\n\t\t}\n\n\t\t// Yes. Then, enforce the certifiers identifier is this is specified.\n\t\t// It is not specified, it means that any certification path is fine.\n\t\tif len(nodeOU.CertifiersIdentifier) != 0 && !bytes.Equal(nodeOU.CertifiersIdentifier, OU.CertifiersIdentifier) {\n\t\t\treturn errors.Errorf(\"certifiersIdentifier does not match: %v, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t\t}\n\t\tcounter++\n\t\tif counter > 1 {\n\t\t\tbreak\n\t\t}\n\t}\n\n\t// the identity should have exactly one OU role, return an error if the counter is not 1.\n\tif counter == 0 {\n\t\treturn errors.Errorf(\"the identity does not have an OU that resolves to client or peer. OUs: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t}\n\tif counter > 1 {\n\t\treturn errors.Errorf(\"the identity must be a client or a peer identity to be valid, not a combination of them. OUs: %s, MSP: [%s]\", OUIDs(id.GetOrganizationalUnits()), msp.name)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L197-L233","documentation":"The identity's OU matched a configured NodeOU, but the OU's CertifiersIdentifier (the SKI of the CA that must have issued the certificate) does not match the identifier of the CA that actually signed this identity's certificate. Fabric throws this when NodeOUs specify an OrganizationalUnitIdentifiers restriction and the issuing CA is not one of the allowed certifiers.","triggerScenarios":"msp.Validate(identity) with NodeOUs where ClientOUIdentifier/PeerOUIdentifier has a non-empty Certificate (CertifiersIdentifier) field, and bytes.Equal(nodeOU.CertifiersIdentifier, OU.CertifiersIdentifier) fails.","commonSituations":"Certificate issued by an intermediate/root CA whose Subject Key Identifier differs from the one configured in the NodeOU's certifier PEM; MSP config copied from another network; CA rotated and SKI changed but config not updated.","solutions":["Update the NodeOU identifier's Certificate field with the PEM of the CA that actually issued the identity certificates","Reissue the identity certificate using the CA whose SKI matches the configured CertifiersIdentifier","Remove the Certificate field from the OU identifier if any certification path from the MSP is acceptable"],"exampleFix":"// before\nClientOUIdentifier:\n  OrganizationalUnitIdentifier: client\n  Certificate: ca_old.pem\n// after: point to the CA that actually signs identities\nClientOUIdentifier:\n  OrganizationalUnitIdentifier: client\n  Certificate: ca_current.pem","handlingStrategy":"validation","validationCode":"import (\"crypto/x509\")\nfunc certSKI(cert *x509.Certificate) ([]byte, error) {\n    for _, ext := range cert.Extensions {\n        if ext.Id.String() == \"2.5.29.14\" {\n            var ski []byte\n            _, err := asn1.Unmarshal(ext.Value, &ski)\n            return ski, err\n        }\n    }\n    return nil, fmt.Errorf(\"no SKI\")\n}\n// Compare SKI of the configured certifier PEM with the SKI of the CA that\n// signed the identity cert before validating.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whenever the issuing CA changes, update the Certificate field of the NodeOU identifier","Use the exact issuing (intermediate) CA PEM, not the root, in OU identifier config","Verify with: openssl x509 -in ca.pem -noout -text | grep -A1 'Subject Key Identifier'"],"tags":["fabric","msp","x509","pki"],"backgroundTag":"certifier-identifier-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}