{"record":{"id":"d3ad8a622d40eca1","repo":"hyperledger/fabric","slug":"an-x509-certificate-with-basic-constraint-certifi","errorCode":null,"errorMessage":"An X509 certificate with Basic Constraint: Certificate Authority equals true cannot be used as an identity","messagePattern":"An X509 certificate with Basic Constraint: Certificate Authority equals true cannot be used as an identity","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":719,"sourceCode":"\tdefault:\n\t\treturn nil, errors.New(\"identity type not recognized\")\n\t}\n}\n\n// getCertificationChainForBCCSPIdentity returns the certification chain of the passed bccsp identity within this msp\nfunc (msp *bccspmsp) getCertificationChainForBCCSPIdentity(id *identity) ([]*x509.Certificate, error) {\n\tif id == nil {\n\t\treturn nil, errors.New(\"Invalid bccsp identity. Must be different from nil.\")\n\t}\n\n\t// we expect to have a valid VerifyOptions instance\n\tif msp.opts == nil {\n\t\treturn nil, errors.New(\"Invalid msp instance\")\n\t}\n\n\t// CAs cannot be directly used as identities..\n\tif id.cert.IsCA {\n\t\treturn nil, errors.New(\"An X509 certificate with Basic Constraint: \" +\n\t\t\t\"Certificate Authority equals true cannot be used as an identity\")\n\t}\n\n\treturn msp.getValidationChain(id.cert, false)\n}\n\nfunc (msp *bccspmsp) getUniqueValidationChain(cert *x509.Certificate, opts x509.VerifyOptions) ([]*x509.Certificate, error) {\n\t// ask golang to validate the cert for us based on the options that we've built at setup time\n\tif msp.opts == nil {\n\t\treturn nil, errors.New(\"the supplied identity has no verify options\")\n\t}\n\tvalidationChains, err := cert.Verify(opts)\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"the supplied identity is not valid\")\n\t}\n\n\t// we only support a single validation chain;\n\t// if there's more than one then there might","sourceCodeStart":701,"sourceCodeEnd":737,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L701-L737","documentation":"This MSP implementation refuses any identity whose X.509 certificate has BasicConstraints CA=true. CA certificates define trust; they are never valid end-entity identities, so using one as an identity would let a CA impersonate arbitrary peers. getCertificationChainForBCCSPIdentity rejects the cert before building its validation chain.","triggerScenarios":"Calling validateIdentity (or getCertificationChain via getCertificationChainForBCCSPIdentity) with an identity serialized from a CA certificate (id.cert.IsCA true), e.g. enrolling with or registering the fabric-ca server's or root CA's cert as the client identity.","commonSituations":"Developers copy the wrong PEM from a crypto-config tree: they grab ca-cert.pem or the intermediate CA cert instead of the signcerts/ endpoint certificate; or they misconfigure an SDK to use the org CA cert as the user's signing identity.","solutions":["Use the end-entity certificate from the MSP signcerts directory (or the issued client cert from fabric-ca enroll), not ca-cert.pem","Verify the cert's BasicConstraints before use: reject any cert with IsCA=true","Re-enroll the identity with fabric-ca-client enroll to obtain a proper non-CA certificate","If an intermediate CA chain is needed, provide the intermediate certs in the MSP intermediatescerts folder, not as the identity"],"exampleFix":"// before\nident, _ := msp.SerializeSigningIdentity(orgCACert.Raw, signerKey)\n// after\nident, _ := msp.SerializeSigningIdentity(clientEndEntityCert.Raw, signerKey)","handlingStrategy":"validation","validationCode":"func isCA(cert *x509.Certificate) bool { return cert.IsCA }\nif isCA(clientCert) { return errors.New(\"CA cert cannot be used as identity\") }","typeGuard":"func isEndEntity(cert *x509.Certificate) bool {\n\treturn cert != nil && !cert.IsCA && cert.KeyUsage&x509.KeyUsageCertSign == 0\n}","tryCatchPattern":null,"preventionTips":["Always take the identity cert from msp/signcerts/, never ca-cert.pem","Check BasicConstraints/IsCA on any externally sourced cert before serializing as an identity","Document which PEM in the crypto tree is an identity vs a trust anchor"],"tags":["x509","msp","fabric","certificate-validation"],"backgroundTag":"ca-certificate-used-as-identity","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}