{"record":{"id":"977c75e4c309d3b5","repo":"hyperledger/fabric","slug":"not-valid-public-key","errorCode":null,"errorMessage":"not valid public key","messagePattern":"not valid public key","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/util.go","lineNumber":726,"sourceCode":"\t}\n\n\treturn tlsBinding, nil\n}\n\nfunc VerifySignature(identity, msgHash, signature []byte) error {\n\tblock, _ := pem.Decode(identity)\n\tif block == nil {\n\t\treturn errors.New(\"pem decoding failed\")\n\t}\n\n\tcert, err := x509.ParseCertificate(block.Bytes)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"key extraction failed\")\n\t}\n\n\tpubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)\n\tif !isECDSA {\n\t\treturn errors.New(\"not valid public key\")\n\t}\n\n\tvalidSignature := ecdsa.VerifyASN1(pubKey, msgHash, signature)\n\n\tif !validSignature {\n\t\treturn errors.New(\"signature invalid\")\n\t}\n\treturn nil\n}\n\nfunc SHA256Digest(data []byte) []byte {\n\thash := sha256.Sum256(data)\n\treturn hash[:]\n}\n\n// VerifyBlocksBFT verifies the given consecutive sequence of blocks is valid, always verifies signature,\n// and returns nil if it's valid, else an error.\nfunc VerifyBlocksBFT(blocks []*common.Block, signatureVerifier protoutil.BlockVerifierFunc, vb protoutil.VerifierBuilder) error {","sourceCodeStart":708,"sourceCodeEnd":744,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/util.go#L708-L744","documentation":"VerifySignature only supports ECDSA signers. After extracting the certificate's public key, a type assertion to *ecdsa.PublicKey is performed; if the certificate was signed with (or carries) an RSA or Ed25519 public key, the assertion fails and this error is returned.","triggerScenarios":"Calling VerifySignature with an identity certificate whose public key algorithm is RSA, Ed25519, or ECDSA-with-different-curve that isn't *ecdsa.PublicKey — the signature may even be valid, but the verifier refuses non-ECDSA keys.","commonSituations":"Fabric network deployed with RSA certificates (e.g. certs issued by a corporate CA defaulting to RSA) where the cluster verification path expects ECDSA; MSP crypto config switched between ecdsa and rsa after enrollment.","solutions":["Issue/use an ECDSA certificate (e.g. P-256) for the node identity","Set the MSP/crypto-config key algorithm to ecdsa and re-enroll the identity","If RSA/Ed25519 support is required, extend VerifySignature to branch on cert.PublicKey type and use rsa.VerifyPKCS1v15 or ed25519.Verify accordingly","Check the inner CA and leaf use the same algorithm family"],"exampleFix":"// before\npubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)\nif !isECDSA {\n    return errors.New(\"not valid public key\")\n}\n// after\nswitch pub := cert.PublicKey.(type) {\ncase *ecdsa.PublicKey:\n    valid := ecdsa.VerifyASN1(pub, msgHash, signature)\ncase ed25519.PublicKey:\n    valid := ed25519.Verify(pub, msgHash, signature)\ndefault:\n    return errors.New(\"unsupported public key algorithm\")\n}","handlingStrategy":"validation","validationCode":"blk, _ := pem.Decode(certPEM)\ncert, err := x509.ParseCertificate(blk.Bytes)\nif err != nil { return err }\nif _, ok := cert.PublicKey.(*ecdsa.PublicKey); !ok {\n    return fmt.Errorf(\"cert public key is %v, ECDSA required\", cert.PublicKeyAlgorithm)\n}","typeGuard":"func isECDSACertPEM(data []byte) bool {\n    blk, _ := pem.Decode(data)\n    if blk == nil { return false }\n    cert, err := x509.ParseCertificate(blk.Bytes)\n    if err != nil { return false }\n    _, ok := cert.PublicKey.(*ecdsa.PublicKey)\n    return ok\n}","tryCatchPattern":"err := cluster.VerifySignature(identityPEM, hash, sig)\nif err != nil && strings.Contains(err.Error(), \"not valid public key\") {\n    return fmt.Errorf(\"identity is not an ECDSA certificate; re-enroll with ecdsa: %w\", err)\n}","preventionTips":["Configure crypto-config/MSP with PublicKeyAlgorithm ecdsa before enrolling","Check leaf and CA algorithms match (openssl x509 -text | grep 'Public Key Algorithm')","Standardize on ECDSA P-256 across the network","Document algorithm requirements in deployment configs"],"tags":["ecdsa","x509","crypto","signature"],"backgroundTag":"unsupported-public-key-algorithm","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}