{"record":{"id":"d006154b342e693c","repo":"hyperledger/fabric","slug":"the-certificate-has-been-revoked","errorCode":null,"errorMessage":"The certificate has been revoked","messagePattern":"The certificate has been revoked","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":143,"sourceCode":"\t\t\t\t\t// certificate that is under validation. As a\n\t\t\t\t\t// precaution, we verify that said CA is also the\n\t\t\t\t\t// signer of this CRL.\n\t\t\t\t\terr = validationChain[1].CheckCRLSignature(crl)\n\t\t\t\t\tif err != nil {\n\t\t\t\t\t\t// the CA cert that signed the certificate\n\t\t\t\t\t\t// that is under validation did not sign the\n\t\t\t\t\t\t// candidate CRL - skip\n\t\t\t\t\t\tmspLogger.Warningf(\"Invalid signature over the identified CRL, error %+v\", err)\n\t\t\t\t\t\tcontinue\n\t\t\t\t\t}\n\n\t\t\t\t\t// A CRL also includes a time of revocation so that\n\t\t\t\t\t// the CA can say \"this cert is to be revoked starting\n\t\t\t\t\t// from this time\"; however here we just assume that\n\t\t\t\t\t// revocation applies instantaneously from the time\n\t\t\t\t\t// the MSP config is committed and used so we will not\n\t\t\t\t\t// make use of that field\n\t\t\t\t\treturn errors.New(\"The certificate has been revoked\")\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) validateIdentityOUsV1(id *identity) error {\n\t// Check that the identity's OUs are compatible with those recognized by this MSP,\n\t// meaning that the intersection is not empty.\n\tif len(msp.ouIdentifiers) > 0 {\n\t\tfound := false\n\n\t\tfor _, OU := range id.GetOrganizationalUnits() {\n\t\t\tcertificationIDs, exists := msp.ouIdentifiers[OU.OrganizationalUnitIdentifier]\n\n\t\t\tif exists {","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L125-L161","documentation":"validateCertAgainstChain guard: the certificate under validation is listed in a CRL that was signed by the issuing CA (signature already verified via CheckCRLSignature). The identity has been revoked and fails validation; the revocation is effective per the CRL's revocation time semantics.","triggerScenarios":"Thrown at msp/mspimplvalidate.go:143 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reissue a new certificate for the identity from the CA","Remove the stale CRL from the MSP's RevocationList if the revocation was mistaken","Track the CRL update so peers and orderers pick up the corrected revocation list"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}