{"record":{"id":"d5f4b66f7706e5d3","repo":"hyperledger/fabric","slug":"no-client-root-certificates-found","errorCode":null,"errorMessage":"no client root certificates found","messagePattern":"no client root certificates found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/pkg/comm/server.go","lineNumber":247,"sourceCode":"\t\t)\n\t}\n\treturn gServer.server.Serve(gServer.listener)\n}\n\n// Stop stops the underlying grpc.Server\nfunc (gServer *GRPCServer) Stop() {\n\tgServer.server.Stop()\n}\n\n// internal function to add a PEM-encoded clientRootCA\nfunc (gServer *GRPCServer) appendClientRootCA(clientRoot []byte) error {\n\tcerts, err := pemToX509Certs(clientRoot)\n\tif err != nil {\n\t\treturn errors.WithMessage(err, \"failed to append client root certificate(s)\")\n\t}\n\n\tif len(certs) < 1 {\n\t\treturn errors.New(\"no client root certificates found\")\n\t}\n\n\tfor _, cert := range certs {\n\t\tgServer.tls.AddClientRootCA(cert)\n\t}\n\n\treturn nil\n}\n\n// parse PEM-encoded certs\nfunc pemToX509Certs(pemCerts []byte) ([]*x509.Certificate, error) {\n\tvar certs []*x509.Certificate\n\n\t// it's possible that multiple certs are encoded\n\tfor len(pemCerts) > 0 {\n\t\tvar block *pem.Block\n\t\tblock, pemCerts = pem.Decode(pemCerts)\n\t\tif block == nil {","sourceCodeStart":229,"sourceCodeEnd":265,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/pkg/comm/server.go#L229-L265","documentation":"appendClientRootCA guard: the PEM blob parsed into zero certificates (pemToX509Certs succeeded but returned an empty list), so the clientRoot bytes contain no usable CA certificate even though they may be valid PEM of another type.","triggerScenarios":"Thrown at internal/pkg/comm/server.go:247 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the configured client root CA file contains at least one CERTIFICATE PEM block","Remove unrelated PEM blocks (e.g., keys) from the CA file"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}