{"record":{"id":"d4df8e001345b4bb","repo":"hyperledger/fabric","slug":"public-key-transition-failed-w","errorCode":null,"errorMessage":"public key transition failed: %w","messagePattern":"public key transition failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/crypto/tlsgen/key.go","lineNumber":127,"sourceCode":"\t}\n\tprivKey := encodePEM(\"EC PRIVATE KEY\", privBytes)\n\treturn &CertKeyPair{\n\t\tKey:     privKey,\n\t\tCert:    pubKey,\n\t\tSigner:  privateKey,\n\t\tTLSCert: cert,\n\t}, nil\n}\n\nfunc encodePEM(keyType string, data []byte) []byte {\n\treturn pem.EncodeToMemory(&pem.Block{Type: keyType, Bytes: data})\n}\n\n// RFC 7093, Section 2, Method 4\nfunc computeSKI(key *ecdsa.PublicKey) ([]byte, error) {\n\tecdhPk, err := key.ECDH()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"public key transition failed: %w\", err)\n\t}\n\n\thash := sha256.Sum256(ecdhPk.Bytes())\n\treturn hash[:], nil\n}\n","sourceCodeStart":109,"sourceCodeEnd":133,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/crypto/tlsgen/key.go#L109-L133","documentation":"computeSKI derives the Subject Key Identifier per RFC 7093 Method 4 by converting the ECDSA public key to an ECDH key (key.ECDH()). If the key cannot be converted (unsupported curve or non-ECDH-compatible key), this wrapped error is returned.","triggerScenarios":"newCertKeyPair generating a certificate whose ECDSA public key uses a curve not supported by crypto/ecdh (e.g., P-224/secp224r1 or other exotic curves).","commonSituations":"Configuring a CA with a custom curve; older key material using curves outside P-256/P-384/P-521.","solutions":["Use a standard curve: P-256 (ECDSA), P-384, or P-521 for the CA key","Check the curve configured in your CA setup code/fabric.yaml and switch to elliptic.P256()","Regenerate key material with a supported curve"],"exampleFix":"// before\npriv, _ := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)\nca, err := tlsgen.NewCA(priv) // fails in computeSKI\n// after\npriv, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)\nca, err := tlsgen.NewCA(priv)","handlingStrategy":"validation","validationCode":"func isSupportedCurve(curve elliptic.Curve) bool {\n    switch curve {\n    case elliptic.P256(), elliptic.P384(), elliptic.P521():\n        return true\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":"ca, err := tlsgen.NewCA()\nif err != nil && strings.Contains(err.Error(), \"public key transition failed\") {\n    return fmt.Errorf(\"unsupported CA key curve: %w\", err)\n}","preventionTips":["Always generate CA keys with P-256/P-384/P-521","Never import legacy key material with non-ECDH curves into tlsgen","Document the supported curve list in CA provisioning scripts"],"tags":["crypto","ecdh","ski","curve"],"backgroundTag":"public-key-conversion-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}