{"record":{"id":"be1e4271cbb779b1","repo":"hyperledger/fabric","slug":"proposal-client-identity-expired","errorCode":null,"errorMessage":"proposal client identity expired","messagePattern":"proposal client identity expired","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/handlers/auth/filter/expiration.go","lineNumber":51,"sourceCode":"\nfunc validateProposal(signedProp *peer.SignedProposal) error {\n\tprop, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed parsing proposal\")\n\t}\n\n\thdr, err := protoutil.UnmarshalHeader(prop.Header)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed parsing header\")\n\t}\n\n\tsh, err := protoutil.UnmarshalSignatureHeader(hdr.SignatureHeader)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"failed parsing signature header\")\n\t}\n\texpirationTime := crypto.ExpiresAt(sh.Creator)\n\tif !expirationTime.IsZero() && time.Now().After(expirationTime) {\n\t\treturn errors.New(\"proposal client identity expired\")\n\t}\n\treturn nil\n}\n\n// ProcessProposal processes a signed proposal\nfunc (f *expirationCheckFilter) ProcessProposal(ctx context.Context, signedProp *peer.SignedProposal) (*peer.ProposalResponse, error) {\n\tif err := validateProposal(signedProp); err != nil {\n\t\treturn nil, err\n\t}\n\treturn f.next.ProcessProposal(ctx, signedProp)\n}\n","sourceCodeStart":33,"sourceCodeEnd":63,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/auth/filter/expiration.go#L33-L63","documentation":"The expiration filter extracted the creator identity and found its certificate expiration time is non-zero and in the past — the submitting client's certificate has expired, so the proposal is denied authentication.","triggerScenarios":"Thrown at core/handlers/auth/filter/expiration.go:51 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Renew or replace the client's MSP certificate and retry","Re-enroll the client identity with a valid CA"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}