{"record":{"id":"84a76121c273ef71","repo":"hyperledger/fabric","slug":"failed-to-create-new-stream","errorCode":null,"errorMessage":"failed to create new stream","messagePattern":"failed to create new stream","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/remotecontext.go","lineNumber":118,"sourceCode":"\t}\n\n\ts.expCheck = &certificateExpirationCheck{\n\t\tminimumExpirationWarningInterval: rc.minimumExpirationWarningInterval,\n\t\texpirationWarningThreshold:       rc.certExpWarningThreshold,\n\t\tendpoint:                         s.Endpoint,\n\t\tnodeName:                         s.NodeName,\n\t\talert: func(template string, args ...any) {\n\t\t\ts.Logger.Warningf(template, args...)\n\t\t},\n\t}\n\n\tif cert := util.ExtractCertificateFromContext(stream.Context()); cert != nil {\n\t\ts.expCheck.expiresAt = cert.NotAfter\n\t}\n\n\terr = stream.Auth()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to create new stream\")\n\t}\n\n\trc.Logger.Debugf(\"Created new stream to %s with ID of %d and buffer size of %d\",\n\t\trc.endpoint, streamID, cap(s.sendBuff))\n\n\trc.streamsByID.Store(streamID, s)\n\trc.Metrics.reportEgressStreamCount(rc.Channel, atomic.LoadUint32(&rc.streamsByID.size))\n\n\tgo func() {\n\t\trc.workerCountReporter.increment(s.metrics)\n\t\ts.serviceStream()\n\t\trc.workerCountReporter.decrement(s.metrics)\n\t}()\n\n\treturn s, nil\n}\n\n// Abort aborts the contexts the RemoteContext uses, thus effectively","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/remotecontext.go#L100-L136","documentation":"NewStream in remotecontext.go wraps any error returned by stream.Auth() with \"failed to create new stream\". Authentication of the newly created gRPC stream to a remote cluster member failed, so the stream is not registered and cannot be used for Step/Deliver traffic.","triggerScenarios":"stream.Auth() fails because the remote node's identity (certificate) is not signed by the expected CA; certificate expiry; TLS handshake succeeded but mutual auth/certificate extraction failed during cluster RPC authentication.","commonSituations":"Expired or rotated TLS certificates not yet trusted by both sides; mismatched TLSRootCAs in General.Cluster config; a node rejoining the cluster after cert rotation before the others got the new CA; wrong TLS handshake timeout (stream still authenticating when deadline hit).","solutions":["Compare the local node's TLS CA cert with General.Cluster.TLS root CAs on the peer side and re-sync certificates","Check certificate expiry dates and renew/rotate TLS certs on the ordering nodes","Verify General.TLS and General.Cluster.TLS settings (enabled, clientAuthRequired, root CAs) are consistent across all nodes","Inspect remote node logs for the underlying auth rejection reason"],"exampleFix":"// before (misconfig example)\nGeneral:\n  TLS:\n    Enabled: true\n  Cluster:\n    TLS:\n      RootCAs: [old-ca.pem]\n// after\nGeneral:\n  TLS:\n    Enabled: true\n  Cluster:\n    TLS:\n      RootCAs: [current-ca.pem]","handlingStrategy":"retry","validationCode":"cert, err := tls.LoadX509KeyPair(tlsCert, tlsKey)\nif err != nil { return fmt.Errorf(\"local TLS material unusable: %w\", err) }\nif time.Now().After(cert.Leaf.NotAfter) { return errors.New(\"TLS certificate expired\") }","typeGuard":null,"tryCatchPattern":"rc := cluster.NewRemoteContext(...)\ns, err := rc.NewStream(endpoint)\nif err != nil && strings.Contains(err.Error(), \"failed to create new stream\") {\n    // re-auth: refresh CAs / certificates, then retry stream creation\n    return err\n}","preventionTips":["Rotate TLS certificates before expiry on all orderers","Keep General.Cluster.TLS root CAs identical across the cluster","Test mutual TLS between nodes after any cert change","Watch remote logs for auth rejections during handshakes"],"tags":["fabric","orderer","tls","authentication","grpc"],"backgroundTag":"stream-authentication-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}