{"record":{"id":"b66ce6194ffed15f","repo":"hyperledger/fabric","slug":"broadcast-client-identity-expired","errorCode":null,"errorMessage":"broadcast client identity expired","messagePattern":"broadcast client identity expired","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/msgprocessor/expiration.go","lineNumber":53,"sourceCode":"// Apply checks whether the identity that created the envelope has expired\nfunc (exp *expirationRejectRule) Apply(message *common.Envelope) error {\n\tordererConf, ok := exp.filterSupport.OrdererConfig()\n\tif !ok {\n\t\tlogger.Panic(\"Programming error: orderer config not found\")\n\t}\n\tif !ordererConf.Capabilities().ExpirationCheck() {\n\t\treturn nil\n\t}\n\tsignedData, err := protoutil.EnvelopeAsSignedData(message)\n\tif err != nil {\n\t\treturn errors.Errorf(\"could not convert message to signedData: %s\", err)\n\t}\n\texpirationTime := crypto.ExpiresAt(signedData[0].Identity)\n\t// Identity cannot expire, or identity has not expired yet\n\tif expirationTime.IsZero() || time.Now().Before(expirationTime) {\n\t\treturn nil\n\t}\n\treturn errors.New(\"broadcast client identity expired\")\n}\n","sourceCodeStart":35,"sourceCodeEnd":55,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/msgprocessor/expiration.go#L35-L55","documentation":"The broadcast client's x509 identity has an expiry timestamp (ExpiresAt) that is in the past. When orderer capabilities enable expiration checking, the msgprocessor rejects any transaction submitted with an expired certificate so stale members cannot keep broadcasting.","triggerScenarios":"Apply on the expiration rule: crypto.ExpiresAt(signedData[0].Identity) is non-zero and time.Now() is after it — a client signed and submitted an envelope using credentials whose notAfter date has passed.","commonSituations":"Long-running client applications or SDK wallets still using certificates that expired since issuance; expired admin certs in a CI pipeline; nodes not rotating MSP certificates before expiry; clock skew is rarely the cause (expiry is genuinely passed).","solutions":["Renew the client certificate from the CA (fabric-ca-client reenroll) and update the wallet/MSP used to sign, then resubmit.","Update the organization's MSP on the channel with the new signer cert if the identity itself was replaced (config update).","Audit and automate cert rotation so identities are refreshed before ExpiresAt; alert on upcoming expiries.","If the whole org's cert expired, perform an MSP/config-block rotation following Fabric's expired-certificate playbook."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"cert := loadedClientCert\nif time.Now().After(cert.NotAfter) { return errors.New(\"client certificate expired; reenroll before broadcasting\") }","typeGuard":null,"tryCatchPattern":"if err := broadcast.Send(env); err != nil && strings.Contains(err.Error(), \"broadcast client identity expired\") { reenroll cert, update wallet/MSP, retry }","preventionTips":["Automate certificate renewal before notAfter (fabric-ca reenroll)","Alert on identities expiring within N days","Rotate org MSP certs via config update when needed","Keep signing wallets in sync with renewed certs"],"tags":["orderer","fabric","identity","certificate-expired","msp"],"backgroundTag":"certificate-expired","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}