{"record":{"id":"c685ec789bf1f4e1","repo":"hyperledger/fabric","slug":"failed-deserializing-identity","errorCode":null,"errorMessage":"failed deserializing identity","messagePattern":"failed deserializing identity","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"discovery/support/acl/support.go","lineNumber":100,"sourceCode":"\tif v == nil {\n\t\tlogger.Panic(\"ConfigtxValidator for channel\", channel, \"is nil\")\n\t}\n\treturn v.Sequence()\n}\n\nfunc (s *DiscoverySupport) SatisfiesPrincipal(channel string, rawIdentity []byte, principal *msp.MSPPrincipal) error {\n\tconf := s.GetChannelConfig(channel)\n\tif conf == nil {\n\t\treturn errors.Errorf(\"channel %s doesn't exist\", channel)\n\t}\n\tmspMgr := conf.MSPManager()\n\tif mspMgr == nil {\n\t\treturn errors.Errorf(\"could not find MSP manager for channel %s\", channel)\n\t}\n\tidentity, err := mspMgr.DeserializeIdentity(rawIdentity)\n\tif err != nil {\n\t\tlogger.Warnw(\"failed deserializing identity\", \"error\", err, \"identity\", protoutil.LogMessageForSerializedIdentity(rawIdentity))\n\t\treturn errors.Wrap(err, \"failed deserializing identity\")\n\t}\n\treturn identity.SatisfiesPrincipal(principal)\n}\n\n// ChannelPolicyManagerGetter is a support interface\n// to get access to the policy manager of a given channel\ntype ChannelPolicyManagerGetter interface {\n\t// Returns the policy manager associated to the passed channel\n\t// and true if it was the manager requested, or false if it is the default manager\n\tManager(channelID string) policies.Manager\n}\n\n// NewChannelVerifier returns a new channel verifier from the given policy and policy manager getter\nfunc NewChannelVerifier(policy string, polMgr policies.ChannelPolicyManagerGetter) *ChannelVerifier {\n\treturn &ChannelVerifier{\n\t\tPolicy:                     policy,\n\t\tChannelPolicyManagerGetter: polMgr,\n\t}","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/discovery/support/acl/support.go#L82-L118","documentation":"The identity bytes supplied in the discovery request's AuthInfo could not be deserialized by the channel's MSP manager, typically because the identity is malformed, from an MSP unknown to the channel, or expired/corrupt. The original MSP error is wrapped with this message.","triggerScenarios":"Client sends a signed discovery request with tlscert/identity bytes that don't parse: wrong certificate in the SDK's identity config, identity from an org not in the channel, or truncated/DER-vs-PEM mixups.","commonSituations":"Enrollment certificate expired or rotated and the client still presents the old cert; using the TLS certificate instead of the signing identity; client's MSP (crypto material folder) not belonging to any org in the channel.","solutions":["Re-enroll or refresh the client's certificate and confirm the identity belongs to an MSP in the channel","Point the client SDK at the correct signing identity material (not the TLS cert) from the org's crypto config","Inspect the wrapped inner error in peer logs for the exact MSP failure (e.g. 'certificate has expired', 'MSP error: ca cert not found')"],"exampleFix":"// before\nidentity, _ := os.ReadFile(\"tls/server.crt\") // wrong cert\n// after\nidentity, _ := os.ReadFile(\"crypto-config/peerOrganizations/org1/users/Admin@org1/msp/signcerts/Admin@org1-cert.pem\")","handlingStrategy":"try-catch","validationCode":"// ensure the cert file parses before use\nblock, _ := pem.Decode(certPEM)\nif block == nil {\n    return errors.New(\"identity is not valid PEM\")\n}\nif _, err := x509.ParseCertificate(block.Bytes); err != nil {\n    return fmt.Errorf(\"identity cert invalid: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"res, err := client.Send(ctx, req)\nif err != nil {\n    var wrapped interface{ Unwrap() error }\n    if strings.Contains(err.Error(), \"failed deserializing identity\") {\n        // rotate/re-enroll identity, then retry\n    }\n    return err\n}","preventionTips":["Use the org's signing identity (signcerts), not the TLS certificate","Monitor certificate expiry and re-enroll proactively","Confirm the client's MSP belongs to an org in the channel"],"tags":["fabric","msp","identity","authorization"],"backgroundTag":"identity-deserialization-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}