{"record":{"id":"d19571d228a1a29a","repo":"hyperledger/fabric","slug":"failed-to-create-x509-verify-options-from-old-and","errorCode":null,"errorMessage":"failed to create x509 verify options from old and new orderer config","messagePattern":"failed to create x509 verify options from old and new orderer config","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/consensus/etcdraft/chain.go","lineNumber":1507,"sourceCode":"\n\tif oldOrdererConfig.ConsensusMetadata() == nil {\n\t\tc.logger.Panic(\"Programming Error: ValidateConsensusMetadata called with nil old metadata\")\n\t\treturn nil\n\t}\n\n\toldMetadata := &etcdraft.ConfigMetadata{}\n\tif err := proto.Unmarshal(oldOrdererConfig.ConsensusMetadata(), oldMetadata); err != nil {\n\t\tc.logger.Panicf(\"Programming Error: Failed to unmarshal old etcdraft consensus metadata: %v\", err)\n\t}\n\n\tnewMetadata := &etcdraft.ConfigMetadata{}\n\tif err := proto.Unmarshal(newOrdererConfig.ConsensusMetadata(), newMetadata); err != nil {\n\t\treturn errors.Wrap(err, \"failed to unmarshal new etcdraft metadata configuration\")\n\t}\n\n\tverifyOpts, err := createX509VerifyOptions(newOrdererConfig)\n\tif err != nil {\n\t\treturn errors.Wrapf(err, \"failed to create x509 verify options from old and new orderer config\")\n\t}\n\n\tif err := VerifyConfigMetadata(newMetadata, verifyOpts); err != nil {\n\t\treturn errors.Wrap(err, \"invalid new config metadata\")\n\t}\n\n\tif newChannel {\n\t\t// check if the consenters are a subset of the existing consenters (system channel consenters)\n\t\tset := ConsentersToMap(oldMetadata.GetConsenters())\n\t\tfor _, c := range newMetadata.GetConsenters() {\n\t\t\tif !set.Exists(c) {\n\t\t\t\treturn errors.New(\"new channel has consenter that is not part of system consenter set\")\n\t\t\t}\n\t\t}\n\t\treturn nil\n\t}\n\n\t// create the dummy parameters for ComputeMembershipChanges","sourceCodeStart":1489,"sourceCodeEnd":1525,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/etcdraft/chain.go#L1489-L1525","documentation":"This error is returned during config update validation in the etcdraft chain when createX509VerifyOptions fails to build x509 verify options from the new orderer config. It is raised inside validateNewCertExpiration (orderer/consensus/etcdraft/chain.go:1507) as a wrapper (errors.Wrapf) around the underlying cause. Verify options derive TLS CA roots from the orderer config, so malformed config prevents certificate verification of new consenters.","triggerScenarios":"A channel config update changes the orderer group while validateNewCertExpiration runs; createX509VerifyOptions fails because the new Orderer config contains no TLS root CAs or yields no valid root certificates.","commonSituations":"Removing or emptying the TLS CA certificate pool from the orderer config; a config update that drops Orderer.TLS.RootCAs/ClientRootCAs; malformed PEM certificates in the channel config.","solutions":["Inspect the wrapped underlying error for the precise cause (e.g. no root CAs found)","Ensure the updated orderer config retains non-empty Orderer.TLS.RootCAs (and ClientRootCAs as needed)","Re-generate and re-upload valid PEM CA certificates to the channel config","Use configtxlator to diff the config update and confirm TLS settings were not accidentally removed"],"exampleFix":"// before (config update removing TLS root CAs)\nOrderer.TLS.RootCAs: []\n// after\nOrderer.TLS.RootCAs: [<PEM bytes of org root CA certs>]","handlingStrategy":"validation","validationCode":"opts, err := createX509VerifyOptions(newOrdererConfig)\nif err != nil {\n    // reject / fix config before update: ensure TLS RootCAs present and valid PEM\n    log.Fatalf(\"orderer config TLS unusable: %v\", err)\n}","typeGuard":"func hasRootCAs(cfg *orderer.Config) bool {\n    return cfg != nil && len(cfg.TLS.RootCAs) > 0\n}","tryCatchPattern":null,"preventionTips":["Always keep non-empty Orderer.TLS.RootCAs in channel config updates","Diff config updates with configtxlator before submission","Never strip TLS sections when editing orderer group config"],"tags":["x509","tls","raft","config-update"],"backgroundTag":"x509-verify-options-invalid","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}