{"record":{"id":"d12a5bf919dc829d","repo":"hyperledger/fabric","slug":"signing-failed","errorCode":null,"errorMessage":"signing failed","messagePattern":"signing failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/commauth.go","lineNumber":281,"sourceCode":"\tbindingFieldsHash := GetSessionBindingHash(payload)\n\n\ttlsBinding, err := GetTLSSessionBinding(cs.StepClient.Context(), bindingFieldsHash)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"TLSBinding failed\")\n\t}\n\tpayload.SessionBinding = tlsBinding\n\n\tasnSignFields, _ := asn1.Marshal(AuthRequestSignature{\n\t\tVersion:        int64(payload.Version),\n\t\tTimestamp:      EncodeTimestamp(payload.Timestamp),\n\t\tFromId:         strconv.FormatUint(payload.FromId, 10),\n\t\tToId:           strconv.FormatUint(payload.ToId, 10),\n\t\tSessionBinding: payload.SessionBinding,\n\t\tChannel:        payload.Channel,\n\t})\n\tsig, err := cs.Signer.Sign(asnSignFields)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"signing failed\")\n\t}\n\n\tpayload.Signature = sig\n\tstepRequest := &orderer.ClusterNodeServiceStepRequest{\n\t\tPayload: &orderer.ClusterNodeServiceStepRequest_NodeAuthrequest{\n\t\t\tNodeAuthrequest: payload,\n\t\t},\n\t}\n\n\treturn cs.StepClient.Send(stepRequest)\n}\n\nfunc (cs *NodeClientStream) Context() context.Context {\n\treturn cs.StepClient.Context()\n}\n\nfunc BuildStepRequest(request *orderer.StepRequest) (*orderer.ClusterNodeServiceStepRequest, error) {\n\tif request == nil {","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/commauth.go#L263-L299","documentation":"After building the ASN.1-encoded AuthRequestSignature fields, Auth() invokes cs.Signer.Sign(asnSignFields) to sign the authentication request. If the signer returns an error it is wrapped as 'signing failed'. The stream's signing identity could not produce a signature over the auth payload.","triggerScenarios":"Calling Auth() where cs.Signer.Sign fails — e.g. the signing identity's private key is unavailable, the crypto provider (HSM/PKCS11, software keystore) returns an error, or the MSP signing identity is malformed/expired.","commonSituations":"BCCSP configured for PKCS11 with an unreachable HSM; corrupted or missing keystore files; signing identity loaded from the wrong MSP directory; key type not supported by the configured crypto provider.","solutions":["Inspect the wrapped underlying error (errors.Wrap preserves it) to identify the crypto-provider failure and fix that root cause.","Verify the BCCSP/keystore configuration (msp directory, bccsp section) and that the private key file is present and readable.","If using HSM, confirm the PKCS11 library path, PIN, and slot configuration are correct and the HSM is reachable.","Regenerate/re-enroll the orderer's signing identity if the key material is corrupt."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if stream != nil && stream.Signer != nil {\n    // signer present; still verify key availability at startup\n    if err := verifySignerUsable(stream.Signer); err != nil {\n        return err\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := stream.Auth(); err != nil {\n    if strings.Contains(err.Error(), \"signing failed\") {\n        // inspect wrapped cause; check BCCSP/HSM health before retry\n        return fmt.Errorf(\"auth signing: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate BCCSP/keystore configuration at process startup, not on first use.","Monitor HSM/PKCS11 connectivity if using hardware signing.","Alert on wrapped crypto errors from the signer rather than retrying blindly."],"tags":["fabric","crypto","signing","msp"],"backgroundTag":"signing-operation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}