{"record":{"id":"802a9111529e1a86","repo":"hyperledger/fabric","slug":"failed-obtaining-msps-from-mspmanager","errorCode":null,"errorMessage":"failed obtaining MSPs from MSPManager","messagePattern":"failed obtaining MSPs from MSPManager","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/util.go","lineNumber":331,"sourceCode":"\n// EndpointconfigFromConfigBlock retrieves TLS CA certificates and endpoints\n// from a config block.\nfunc EndpointconfigFromConfigBlock(block *common.Block, bccsp bccsp.BCCSP) ([]EndpointCriteria, error) {\n\tif block == nil {\n\t\treturn nil, errors.New(\"nil block\")\n\t}\n\tenvelopeConfig, err := protoutil.ExtractEnvelope(block, 0)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tbundle, err := channelconfig.NewBundleFromEnvelope(envelopeConfig, bccsp)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed extracting bundle from envelope\")\n\t}\n\tmsps, err := bundle.MSPManager().GetMSPs()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed obtaining MSPs from MSPManager\")\n\t}\n\tordererConfig, ok := bundle.OrdererConfig()\n\tif !ok {\n\t\treturn nil, errors.New(\"failed obtaining orderer config from bundle\")\n\t}\n\n\tmspIDsToCACerts := make(map[string][][]byte)\n\tvar aggregatedTLSCerts [][]byte\n\tfor _, org := range ordererConfig.Organizations() {\n\t\t// Validate that every orderer org has a corresponding MSP instance in the MSP Manager.\n\t\tmsp, exists := msps[org.MSPID()]\n\t\tif !exists {\n\t\t\treturn nil, errors.Errorf(\"no MSP found for MSP with ID of %s\", org.MSPID())\n\t\t}\n\n\t\t// Build a per org mapping of the TLS CA certs for this org,\n\t\t// and aggregate all TLS CA certs into aggregatedTLSCerts to be used later on.\n\t\tvar caCerts [][]byte","sourceCodeStart":313,"sourceCodeEnd":349,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/util.go#L313-L349","documentation":"EndpointconfigFromConfigBlock parses a config block into a channelconfig.Bundle and then asks the bundle's MSPManager for its MSP instances. This error is a wrap of whatever failure occurred inside MSPManager.GetMSPs(), meaning the channel MSP configuration (the MSPs defined in the channel config) could not be instantiated, e.g. invalid MSP definition material.","triggerScenarios":"Calling cluster.EndpointconfigFromConfigBlock (directly or via BlockPuller / EndpointconfigFromSupport) with a config block whose Application/MSP config contains malformed MSP definitions (bad intermediate certs, wrong node-OU config, invalid crypto material) so bundle.MSPManager().GetMSPs() returns an error.","commonSituations":"Channel config transactions generated with corrupted or hand-edited MSP certificates, MSPs with unsupported type or missing admin/root certs, or config blocks copied between networks with inconsistent MSP material.","solutions":["Inspect the wrapped cause in the error chain; it names the MSP and the exact material problem.","Regenerate the channel config tx with valid, unmodified MSP crypto material (configtxgen with correct crypto-config).","Verify the MSP definition in the config block (decode with configtxlator) and fix root/intermediate certs, admin certs, or FabricNodeOUs settings.","Re-issue the config update through a proper config update transaction, not manual block editing."],"exampleFix":"// before: hand-edited MSP certs inside config block\n// after: regenerate config tx\n// configtxgen -profile MyChannel -outputCreateChannelTx mychannel.tx -channelID mychannel\n// then submit the update via the ordering service","handlingStrategy":"try-catch","validationCode":"// Verify MSP material is parseable before building endpoint config\nrootCAs, err := caCertPool(certs)\nif err != nil { return fmt.Errorf(\"invalid CA certs for MSP %s: %w\", mspID, err) }","typeGuard":null,"tryCatchPattern":"cfg, err := cluster.EndpointconfigFromConfigBlock(block, bccsp)\nif err != nil {\n    if strings.Contains(err.Error(), \"failed obtaining MSPs\") {\n        var unwrapped error = errors.Unwrap(err)\n        log.Errorf(\"MSP manager failure: %v\", unwrapped)\n        return fmt.Errorf(\"config block MSP material invalid: %w\", err)\n    }\n    return err\n}","preventionTips":["Never hand-edit certificates inside channel config blocks.","Generate all MSP material with configtxgen/cryptogen or an HSM-backed CA pipeline.","Validate generated config tx with configtxlator before submitting."],"tags":["fabric","msp","config-block","orderer"],"backgroundTag":"invalid-msp-configuration","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}