{"record":{"id":"8942159ecc2c9e45","repo":"hyperledger/fabric","slug":"s-wrong-pem-encoding-894215","errorCode":null,"errorMessage":"%s: wrong PEM encoding","messagePattern":"(.+?): wrong PEM encoding","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":240,"sourceCode":"\n\t// Extract the public part of the identity\n\tidPub, pubKey, err := msp.getIdentityFromConf(sidInfo.PublicSigner)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\t// Find the matching private key in the BCCSP keystore\n\tprivKey, err := msp.bccsp.GetKey(pubKey.SKI())\n\t// Less Secure: Attempt to import Private Key from KeyInfo, if BCCSP was not able to find the key\n\tif err != nil {\n\t\tmspLogger.Debugf(\"Could not find SKI [%s], trying KeyMaterial field: %+v\\n\", hex.EncodeToString(pubKey.SKI()), err)\n\t\tif sidInfo.PrivateSigner == nil || sidInfo.PrivateSigner.KeyMaterial == nil {\n\t\t\treturn nil, errors.New(\"KeyMaterial not found in SigningIdentityInfo\")\n\t\t}\n\n\t\tpemKey, _ := pem.Decode(sidInfo.PrivateSigner.KeyMaterial)\n\t\tif pemKey == nil {\n\t\t\treturn nil, errors.Errorf(\"%s: wrong PEM encoding\", sidInfo.PrivateSigner.KeyIdentifier)\n\t\t}\n\t\tprivKey, err = msp.bccsp.KeyImport(pemKey.Bytes, &bccsp.ECDSAPrivateKeyImportOpts{Temporary: true})\n\t\tif err != nil {\n\t\t\treturn nil, errors.WithMessage(err, \"getIdentityFromBytes error: Failed to import EC private key\")\n\t\t}\n\t}\n\n\t// get the peer signer\n\tpeerSigner, err := signer.New(msp.bccsp, privKey)\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"getIdentityFromBytes error: Failed initializing bccspCryptoSigner\")\n\t}\n\n\treturn newSigningIdentity(idPub.(*identity).cert, idPub.(*identity).pk, peerSigner, msp)\n}\n\n// Setup sets up the internal data structures\n// for this MSP, given an MSPConfig ref; it","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L222-L258","documentation":"Raised in getSigningIdentityFromConf while importing the private key from the KeyMaterial fallback field: the KeyMaterial bytes could not be PEM-decoded into a usable private key. BCCSP could not find the key by SKI in its keystore, and the inline KeyMaterial in the config is empty, corrupted, or not a PEM-encoded key.","triggerScenarios":"SigningIdentityInfo.PrivateSigner.KeyMaterial containing raw DER key bytes, an empty non-nil slice, or a non-key PEM block while the SKI lookup also missed the keystore.","commonSituations":"Storing the key base64-only (no BEGIN/END lines); pasting an encrypted PKCS#8 blob with damaged armor; a generator that forgot to PEM-encode the key before embedding.","solutions":["PEM-encode the private key (-----BEGIN PRIVATE KEY-----) before setting KeyMaterial","Round-trip validate: pem.Decode the value in a unit test before configuring the MSP","If relying on the keystore instead, fix the SKI lookup so this fallback path is never taken"],"exampleFix":"// before\nKeyMaterial: derKeyBytes\n// after\nKeyMaterial: pem.EncodeToMemory(&pem.Block{Type: \"PRIVATE KEY\", Bytes: derKeyBytes})","handlingStrategy":"validation","validationCode":"if blk, _ := pem.Decode(info.PrivateSigner.KeyMaterial); blk == nil {\n    return fmt.Errorf(\"key %s: KeyMaterial is not PEM-encoded\", info.PrivateSigner.KeyIdentifier)\n}","typeGuard":"func pemDecodable(b []byte) (*pem.Block, bool) {\n    blk, _ := pem.Decode(b)\n    return blk, blk != nil\n}","tryCatchPattern":"if err := msp.Setup(conf); err != nil && strings.Contains(err.Error(), \"wrong PEM encoding\") {\n    return fmt.Errorf(\"re-embed the private key as PEM: %w\", err)\n}","preventionTips":["Always wrap key DER bytes with pem.EncodeToMemory before embedding in config","Avoid copy-paste paths that strip BEGIN/END lines or rewrap long lines","Round-trip pem.Decode in tests for every embedded KeyMaterial"],"tags":["msp","pem","private-key"],"backgroundTag":"invalid-pem-encoded-key","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}