{"record":{"id":"b4c67769033e74d1","repo":"hyperledger/fabric","slug":"failed-obtaining-msps-from-mspmanager-b4c677","errorCode":null,"errorMessage":"failed obtaining MSPs from MSPManager","messagePattern":"failed obtaining MSPs from MSPManager","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/consensus/smartbft/util.go","lineNumber":294,"sourceCode":"\t\tsigHdr:   sigHdr,\n\t\tenvelope: envelope,\n\t}, nil\n}\n\n// remoteNodesFromConfigBlock unmarshalls the node config from the block metadata\nfunc remoteNodesFromConfigBlock(block *cb.Block, logger *flogging.FabricLogger, bccsp bccsp.BCCSP) (*nodeConfig, error) {\n\tenv := &cb.Envelope{}\n\tif err := proto.Unmarshal(block.Data.Data[0], env); err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed unmarshalling envelope of config block\")\n\t}\n\tbundle, err := channelconfig.NewBundleFromEnvelope(env, bccsp)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed getting a new bundle from envelope of config block\")\n\t}\n\n\tchannelMSPs, err := bundle.MSPManager().GetMSPs()\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed obtaining MSPs from MSPManager\")\n\t}\n\n\toc, ok := bundle.OrdererConfig()\n\tif !ok {\n\t\treturn nil, errors.New(\"no orderer config in config block\")\n\t}\n\n\t_, err = createSmartBftConfig(oc)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tvar nodeIDs []uint64\n\tvar remoteNodes []cluster.RemoteNode\n\tid2Identies := map[uint64][]byte{}\n\tfor _, consenter := range oc.Consenters() {\n\t\tsanitizedID, err := crypto.SanitizeIdentity(protoutil.MarshalOrPanic(&msp.SerializedIdentity{\n\t\t\tIdBytes: consenter.Identity,","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/smartbft/util.go#L276-L312","documentation":"After successfully building the channelconfig bundle from the config block, remoteNodesFromConfigBlock calls bundle.MSPManager().GetMSPs() to enumerate the channel's MSPs. This error wraps a failure inside the MSP manager, typically when one of the configured MSP definitions cannot be built or loaded (invalid MSP config bytes, unsupported provider type, or BCCSP crypto failures). The channel's MSP configuration in the block is unparseable or unsatisfiable.","triggerScenarios":"configBlockCommitted -> remoteNodesFromConfigBlock -> bundle.MSPManager().GetMSPs() returns error because the channel config's MSPs key contains an MSP definition that msp.New (via the MSP manager) fails to instantiate given the node's BCCSP provider.","commonSituations":"Channel config contains an MSP with corrupt/invalid root cert material; MSP of a provider type the orderer node doesn't support (e.g. idemix vs x509 mixing issues); BCCSP config (e.g. PKCS11) misconfigured on the node so MSP instantiation fails; config block generated with certs that failed re-encoding through configtxlator.","solutions":["Read the wrapped underlying error to find which MSP ID or config element failed instantiation","Validate the MSP directory (cacerts, intermediatecerts, admincerts) used to build the channel config; regenerate with correct certs via configtxgen","Check the orderer's BCCSP configuration (mspConfigPath, crypto provider, PKCS11 settings) matches the MSP type in the channel config","Update the channel config to remove/fix the offending MSP with a channel config update transaction","Re-encode the config with the same Fabric version's configtxlator to avoid proto/cert re-encoding corruption"],"exampleFix":"// before: channel config MSP built from a directory with missing/invalid cacerts\nOrganizationalUnitIdentifiers: ...\n// msp config dir has no cacerts/\n\n// after: regenerate channel config from a complete MSP directory\n// configtx.yaml:\n//   Organizations:\n//     - Name: OrdererOrg\n//       MSPDir: ./crypto-config/ordererOrganizations/example.com/msp  # contains cacerts/\n// then: configtxgen -profile ... -channelID ... -outputCreateChannelTx ...","handlingStrategy":"validation","validationCode":"bundle, err := channelconfig.NewBundleFromEnvelope(env, bccsp)\nif err != nil {\n    return err\n}\nif _, err := bundle.MSPManager().GetMSPs(); err != nil {\n    return fmt.Errorf(\"channel MSPs invalid before committing config: %w\", err)\n}\n// Also validate MSP dirs used to build the config beforehand:\n// ensure cacerts/, intermediatecerts/ exist and certs parse with x509.ParseCertificate","typeGuard":"func channelMSPsLoadable(bundle *channelconfig.Bundle) error {\n    if bundle == nil {\n        return errors.New(\"nil bundle\")\n    }\n    _, err := bundle.MSPManager().GetMSPs()\n    return err\n}","tryCatchPattern":"_, err := bundle.MSPManager().GetMSPs()\nif err != nil {\n    // wrapped as \"failed obtaining MSPs from MSPManager\"\n    var provErr *bccspFactoryError // if using PKCS11/BCCSP wrappers\n    if errors.As(err, &provErr) {\n        return fmt.Errorf(\"fix BCCSP/PKCS11 config and restart orderer: %w\", err)\n    }\n    return fmt.Errorf(\"rebuild channel config MSPs (check cacerts) via configtxgen: %w\", err)\n}","preventionTips":["Validate every MSP directory (cacerts present, certs parse) before including it in configtx.yaml","Keep BCCSP settings (provider, PKCS11 library/pin) identical across orderers in the cluster","Test new MSP additions on a channel in a staging network before production config update","Pin Fabric versions across orderers so MSP config schema expectations match"],"tags":["hyperledger-fabric","msp","orderer","config-block"],"backgroundTag":"invalid-msp-configuration","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}