{"record":{"id":"b1700a7040f56295","repo":"hyperledger/fabric","slug":"number-of-peer-addresses-d-does-not-match-the-n-b1700a","errorCode":null,"errorMessage":"number of peer addresses (%d) does not match the number of TLS root cert files (%d)","messagePattern":"number of peer addresses \\((.+?)\\) does not match the number of TLS root cert files \\((.+?)\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/peer/lifecycle/chaincode/client_connections.go","lineNumber":139,"sourceCode":"\t\t}\n\t}\n\n\t// currently only support multiple peer addresses for _lifecycle\n\t// for approveformyorg and commit\n\tmultiplePeersAllowed := map[string]bool{\n\t\t\"approveformyorg\": true,\n\t\t\"commit\":          true,\n\t}\n\tif !multiplePeersAllowed[input.CommandName] && len(input.PeerAddresses) > 1 {\n\t\treturn errors.Errorf(\"'%s' command supports one peer. %d peers provided\", input.CommandName, len(input.PeerAddresses))\n\t}\n\n\tif !input.TLSEnabled {\n\t\tinput.TLSRootCertFiles = nil\n\t\treturn nil\n\t}\n\tif len(input.TLSRootCertFiles) != len(input.PeerAddresses) {\n\t\treturn errors.Errorf(\"number of peer addresses (%d) does not match the number of TLS root cert files (%d)\", len(input.PeerAddresses), len(input.TLSRootCertFiles))\n\t}\n\n\treturn nil\n}\n\nfunc (c *ClientConnectionsInput) parseConnectionProfile() error {\n\tnetworkConfig, err := common.GetConfig(c.ConnectionProfilePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tc.PeerAddresses = []string{}\n\tc.TLSRootCertFiles = []string{}\n\n\tif c.ChannelID == \"\" {\n\t\tif c.TargetPeer == \"\" {\n\t\t\treturn errors.New(\"--targetPeer must be specified for channel-less operation using connection profile\")\n\t\t}","sourceCodeStart":121,"sourceCodeEnd":157,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/peer/lifecycle/chaincode/client_connections.go#L121-L157","documentation":"Validation in validatePeerConnectionParameters: when TLS is enabled, each --peerAddresses must have a matching --tlsRootCertFiles entry, but the counts differ (%d vs %d). The command cannot establish authenticated connections without one root cert per peer address.","triggerScenarios":"TLSEnabled is true and len(input.TLSRootCertFiles) != len(input.PeerAddresses) — e.g. two peer addresses but one (or zero) TLS root cert files, or certs given while TLS flags resolve differently.","commonSituations":"Forgetting --tlsRootCertFiles for the second --peerAddresses; using a peer address without its matching CA cert path; environment-level CORE_VM or --tls settings inconsistent across flags.","solutions":["Provide one --tlsRootCertFiles per --peerAddresses, in the same order","If the network is not TLS-enabled, pass --tls false so cert checks are skipped","Verify each cert file path exists and corresponds to the CA that signed that peer's TLS cert"],"exampleFix":"// before\n--peerAddresses p0:7051 --peerAddresses p1:8051 --tlsRootCertFiles ca0.pem\n// after\n--peerAddresses p0:7051 --peerAddresses p1:8051 --tlsRootCertFiles ca0.pem --tlsRootCertFiles ca1.pem","handlingStrategy":"validation","validationCode":"if tlsEnabled && len(peerAddresses) != len(tlsRootCertFiles) { return fmt.Errorf(\"need %d tls root certs, got %d\", len(peerAddresses), len(tlsRootCertFiles)) }","typeGuard":null,"tryCatchPattern":"if err := run(cmd); err != nil && strings.Contains(err.Error(), \"does not match the number of TLS root cert files\") { log.Fatal(\"pair each --peerAddresses with a --tlsRootCertFiles\") }","preventionTips":["Build peer/cert pairs together in scripts (arrays of tuples)","Verify each cert path exists before invoking","If network is non-TLS, omit cert flags entirely and use --tls false"],"tags":["fabric","tls","arguments"],"backgroundTag":"tls-cert-mismatch","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}