{"record":{"id":"910442a398540230","repo":"hyperledger/fabric","slug":"failed-to-unmarshal-subject-key-identifier","errorCode":null,"errorMessage":"failed to unmarshal Subject Key Identifier","messagePattern":"failed to unmarshal Subject Key Identifier","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":363,"sourceCode":"\t\t\treturn aki.KeyIdentifier, nil\n\t\t}\n\t}\n\n\treturn nil, errors.New(\"authorityKeyIdentifier not found in certificate\")\n}\n\n// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate\n// Subject Key Identifier is an identifier of the public key of this certificate\nfunc getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {\n\tvar SKI []byte\n\n\tfor _, ext := range cert.Extensions {\n\t\t// Subject Key Identifier is identified by the following ASN.1 tag\n\t\t// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)\n\t\tif reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {\n\t\t\t_, err := asn1.Unmarshal(ext.Value, &SKI)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to unmarshal Subject Key Identifier\")\n\t\t\t}\n\n\t\t\treturn SKI, nil\n\t\t}\n\t}\n\n\treturn nil, errors.New(\"subjectKeyIdentifier not found in certificate\")\n}\n","sourceCodeStart":345,"sourceCodeEnd":372,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L345-L372","documentation":"Extracting the Subject Key Identifier (SKI, OID 2.5.29.14) from a certificate failed at ASN.1 unmarshal time. getSubjectKeyIdentifierFromCert is used to compute/compare key identifiers when building the CA chain (finalizeSetupCAs, setupTLSCAs) and validating certs against the chain, so a malformed SKI extension aborts the operation with this wrapped error.","triggerScenarios":"asn1.Unmarshal(ext.Value, &SKI) fails for the subjectKeyIdentifier extension during setupCAs/TLS CA setup or validateCertAgainstChain on a certificate with a corrupt or non-DER SKI extension value.","commonSituations":"Certificates generated by non-compliant tooling or edited by hand; truncated PEM files in msp/signcerts, cacerts, tlscacerts, or intermediatescerts; conversion errors (e.g. re-encoding certs with broken base64/DER).","solutions":["Replace the malformed certificate with one generated by a standards-compliant tool (openssl, fabric-ca, cryptogen)","Validate each cert: openssl x509 -in cert.pem -noout -text and confirm 'X509v3 Subject Key Identifier' parses","Re-copy the MSP directory from the trusted source (e.g. crypto-config or the org's admin) to rule out file corruption"],"exampleFix":"# before: inspect to find the bad cert\nfor f in msp/cacerts/*.pem; do openssl x509 -in $f -noout -text || echo \"BAD: $f\"; done\n# after: replace BAD cert with a valid one\nopenssl x509 -in valid_ca.pem -out msp/cacerts/ca.pem","handlingStrategy":"validation","validationCode":"import (\"encoding/pem\"; \"crypto/x509\")\nfunc certSKIReadable(certPEM []byte) error {\n    blk, _ := pem.Decode(certPEM)\n    if blk == nil { return fmt.Errorf(\"not PEM\") }\n    cert, err := x509.ParseCertificate(blk.Bytes)\n    if err != nil { return err }\n    if len(cert.SubjectKeyId) == 0 { return fmt.Errorf(\"missing SKI\") }\n    return nil\n}\n// Check cacerts, tlscacerts, intermediatescerts, signcerts before MSP setup.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate every MSP cert with openssl x509 -noout -text during deployment","Avoid manual edits/re-encodings of PEM files; copy MSP trees verbatim","Use cryptogen/fabric-ca exclusively for cert generation"],"tags":["fabric","msp","x509","asn1"],"backgroundTag":"x509-extension-parse-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}