{"record":{"id":"cbfac449234a8ab2","repo":"hyperledger/fabric","slug":"failed-to-access-client-tls-configuration-w","errorCode":null,"errorMessage":"failed to access client TLS configuration: %w","messagePattern":"failed to access client TLS configuration: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/deliverservice/deliveryclient.go","lineNumber":219,"sourceCode":"\t\t},\n\t\tOrderersSourceFactory: &orderers.ConnectionSourceFactory{Overrides: d.conf.OrdererEndpointOverrides},\n\t\tCryptoProvider:        d.conf.CryptoProvider,\n\t\tDoneC:                 make(chan struct{}),\n\t\tSigner:                d.conf.Signer,\n\t\tDeliverStreamer:       blocksprovider.DeliverAdapter{},\n\t\tLogger:                flogging.MustGetLogger(\"peer.blocksprovider\").With(\"channel\", chainID),\n\t\tMaxRetryInterval:      d.conf.DeliverServiceConfig.ReConnectBackoffThreshold,\n\t\tMaxRetryDuration:      d.conf.DeliverServiceConfig.ReconnectTotalTimeThreshold,\n\t\tInitialRetryInterval:  100 * time.Millisecond,\n\t\tMaxRetryDurationExceededHandler: func() (stopRetries bool) {\n\t\t\treturn !d.conf.IsStaticLeader\n\t\t},\n\t}\n\n\tif d.conf.DeliverServiceConfig.SecOpts.RequireClientCert {\n\t\tcert, err := d.conf.DeliverServiceConfig.SecOpts.ClientCertificate()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to access client TLS configuration: %w\", err)\n\t\t}\n\t\tdc.TLSCertHash = util.ComputeSHA256(cert.Certificate[0])\n\t}\n\n\tdc.Initialize(d.conf.ChannelConfig)\n\n\treturn dc, nil\n}\n\nfunc (d *deliverServiceImpl) createBlockDelivererBFT(chainID string, ledgerInfo blocksprovider.LedgerInfo) (*blocksprovider.BFTDeliverer, error) {\n\theight, err := ledgerInfo.LedgerHeight()\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"cannot get ledger height\")\n\t}\n\tcurrentBlockHash, err := ledgerInfo.GetCurrentBlockHash()\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"cannot get current block hash\")\n\t}","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/deliverservice/deliveryclient.go#L201-L237","documentation":"When the deliver service is configured with SecOpts.RequireClientCert=true, createBlockDelivererCFT must load the peer's TLS client certificate to compute TLSCertHash. ClientCertificate() returns the configured client key/cert pair; if the certificate material is missing, unreadable, or inconsistent it fails and this wrapped error is returned. It signals a TLS configuration problem, not a runtime network failure.","triggerScenarios":"Running with RequireClientCert=true while SecOpts has no valid client KeyFile/CertificateFile (or the loaded tls.Certificate has no cert bytes), so SecOpts.ClientCertificate() errors inside createBlockDelivererCFT via StartDeliverForChannel.","commonSituations":"Peer core.yaml TLS section missing tls.clientKeyFile/tls.clientCertFile while tls.clientAuthRequired is true; cert files deleted or unreadable at runtime (permissions, container mount missing); cert/key mismatch causing load failure; mutual-TLS required by orderer but peer config never updated.","solutions":["Set tls.clientCertFile and tls.clientKeyFile in the peer's core.yaml (SecOpts) to valid, matching PEM files when tls.clientAuthRequired is true","Verify the files exist and are readable by the peer process (check volume mounts and file permissions in containers)","Validate that the client certificate/key pair matches (compare public keys/moduli) and re-issue from the same CA if mismatched","If client certs are not required by the ordering service, set RequireClientCert / tls.clientAuthRequired to false to skip loading the client cert"],"exampleFix":"# before (core.yaml)\ntls:\n  clientAuthRequired: true\n  # clientCertFile / clientKeyFile not set\n\n# after\ntls:\n  clientAuthRequired: true\n  clientCertFile: /etc/hyperledger/fabric/tls/client.crt\n  clientKeyFile: /etc/hyperledger/fabric/tls/client.key","handlingStrategy":"validation","validationCode":"if secOpts.RequireClientCert {\n    if _, err := secOpts.ClientCertificate(); err != nil {\n        return fmt.Errorf(\"invalid client TLS config: %w\", err)\n    }\n}","typeGuard":"func hasClientCertPair(certFile, keyFile string) bool {\n    if certFile == \"\" || keyFile == \"\" {\n        return false\n    }\n    _, err := os.Stat(certFile)\n    _, err2 := os.Stat(keyFile)\n    return err == nil && err2 == nil\n}","tryCatchPattern":"dc, err := createBlockDeliverer(chainID)\nvar tlsCfgErr *TLSCertError\nif errors.As(err, &tlsCfgErr) {\n    // fail fast: fix core.yaml tls.clientCertFile / clientKeyFile\n    return fmt.Errorf(\"peer TLS client config invalid: %w\", err)\n}","preventionTips":["Validate TLS files exist and parse at peer startup, not at first delivery","Keep clientCertFile/clientKeyFile set whenever clientAuthRequired is true","Mount cert/key files read-only in containers and verify permissions","Regenerate client cert and key together to avoid mismatched pairs"],"tags":["hyperledger-fabric","tls","configuration","deliver-service"],"backgroundTag":"missing-tls-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}