{"record":{"id":"937f7422af155766","repo":"hyperledger/fabric","slug":"node-identity-certificate-s-is-not-a-valid-pem-937f74","errorCode":null,"errorMessage":"node identity certificate %s is not a valid PEM","messagePattern":"node identity certificate (.+?) is not a valid PEM","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/consensus/smartbft/consenter.go","lineNumber":274,"sourceCode":"\tbundle, err := channelconfig.NewBundleFromEnvelope(envelopeConfig, c.BCCSP)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\toc, exists := bundle.OrdererConfig()\n\tif !exists {\n\t\treturn false, errors.New(\"no orderer config in bundle\")\n\t}\n\tmember := false\n\n\tsantizedCert, err := crypto.SanitizeX509Cert(c.Identity)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\t// Extract public key using the same approach as IsConsenterOfChannel\n\tbl, _ := pem.Decode(santizedCert)\n\tif bl == nil {\n\t\treturn false, errors.Errorf(\"node identity certificate %s is not a valid PEM\", string(santizedCert))\n\t}\n\n\tmyPublicKey, err := cluster.ExtractPublicKeyFromCert(bl.Bytes)\n\tif err != nil {\n\t\tc.Logger.Warningf(\"Failed to extract public key from own certificate: %v\", err)\n\t\treturn false, err\n\t}\n\n\tfor _, consenter := range oc.Consenters() {\n\t\tsantizedCert, err := crypto.SanitizeX509Cert(consenter.Identity)\n\t\tif err != nil {\n\t\t\tc.Logger.Warnf(\"Failed to sanitize consenter %d identity: %v\", consenter.Id, err)\n\t\t\treturn false, err\n\t\t}\n\n\t\t// Extract public key using the same approach as IsConsenterOfChannel\n\t\tbl, _ := pem.Decode(santizedCert)\n\t\tif bl == nil {","sourceCodeStart":256,"sourceCodeEnd":292,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/smartbft/consenter.go#L256-L292","documentation":"IsChannelMember sanitizes the local node identity certificate and PEM-decodes it to extract the public key for comparison against the channel's consenter certs. If pem.Decode returns nil — the bytes are not valid PEM — this error is returned with the offending content embedded. It indicates the orderer's configured identity is not a PEM-encoded certificate.","triggerScenarios":"The orderer's local MSP identity (c.Identity) or the sanitized cert bytes are not PEM — e.g. General.LocalMSPDir points at DER/invalid cert files, an empty identity, or a secret mounted with wrong contents.","commonSituations":"Misconfigured MSP material (certificate file contains a key, concatenated certs, or base64 text); Kubernetes secrets mounted incorrectly into the MSP path; cert rotation replaced the PEM with a DER-encoded certificate.","solutions":["Inspect the identity certificate file at the LocalMSP signcerts path and confirm it is PEM (-----BEGIN CERTIFICATE-----)","Re-generate or re-copy the MSP material ensuring signcerts contains a standard PEM X.509 cert and correct CA certs","Convert DER to PEM if needed (openssl x509 -inform der -in cert.der -out cert.pem) and restart the orderer","Verify the file contents referenced in the log message (the offending bytes are printed) to spot mounting/encoding mistakes"],"exampleFix":"// before: DER certificate in signcerts/\n$ xxd msp/signcerts/cert.pem | head  # binary DER bytes\n\n// after: convert to PEM\n$ openssl x509 -inform der -in cert.der -out msp/signcerts/cert.pem","handlingStrategy":"validation","validationCode":"// Validate the orderer identity cert is PEM before starting/joining\npemBytes, err := os.ReadFile(\"msp/signcerts/cert.pem\")\nif err != nil { return err }\nif block, _ := pem.Decode(pemBytes); block == nil {\n    return errors.New(\"signcerts does not contain a valid PEM certificate\")\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    return fmt.Errorf(\"not an X.509 cert: %w\", err)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check MSP signcerts contain PEM certificates (BEGIN CERTIFICATE headers)","Convert DER certs to PEM before deploying into MSP directories","Verify secret mounts (K8s) contain the right files, not keys or bundles","Include an MSP/PEM sanity check in orderer startup scripts"],"tags":["fabric","pem","tls","certificates","msp"],"backgroundTag":"invalid-pem-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}