{"record":{"id":"dcdb0c8053f66a91","repo":"hyperledger/fabric","slug":"sanitizecert-failed-s","errorCode":null,"errorMessage":"sanitizeCert failed %s","messagePattern":"sanitizeCert failed (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplsetup.go","lineNumber":34,"sourceCode":"\n\t\"github.com/hyperledger/fabric-lib-go/bccsp\"\n\t\"github.com/hyperledger/fabric-lib-go/bccsp/utils\"\n\tm \"github.com/hyperledger/fabric-protos-go-apiv2/msp\"\n\t\"github.com/pkg/errors\"\n\t\"google.golang.org/protobuf/proto\"\n)\n\nfunc (msp *bccspmsp) getCertifiersIdentifier(certRaw []byte) ([]byte, error) {\n\t// 1. check that certificate is registered in msp.rootCerts or msp.intermediateCerts\n\tcert, err := msp.getCertFromPem(certRaw)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"Failed getting certificate for [%v]: [%s]\", certRaw, err)\n\t}\n\n\t// 2. Sanitize it to ensure like for like comparison\n\tcert, err = msp.sanitizeCert(cert)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"sanitizeCert failed %s\", err)\n\t}\n\n\tfound := false\n\troot := false\n\t// Search among root certificates\n\tfor _, v := range msp.rootCerts {\n\t\tif v.(*identity).cert.Equal(cert) {\n\t\t\tfound = true\n\t\t\troot = true\n\t\t\tbreak\n\t\t}\n\t}\n\tif !found {\n\t\t// Search among root intermediate certificates\n\t\tfor _, v := range msp.intermediateCerts {\n\t\t\tif v.(*identity).cert.Equal(cert) {\n\t\t\t\tfound = true\n\t\t\t\tbreak","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L16-L52","documentation":"After parsing the certificate, getCertifiersIdentifier sanitizes it (converting to the internal crypto provider's expected format) via sanitizeCert. If sanitization fails, setup cannot proceed with OU classification and this error is returned wrapping the underlying cause.","triggerScenarios":"sanitizeCert fails on a certificate that parsed but has unsupported signature algorithm, unsupported public key type, or fails re-encoding under the configured BCCSP provider (e.g. SW vs PKCS11).","commonSituations":"Certificates signed with unusual algorithms (e.g. RSA-PSS or Ed25519 unsupported by the BCCSP version), mixed PKCS11 HSM setups, certificates produced by non-standard CAs, Fabric version mismatch where sanitization expectations differ.","solutions":["Read the wrapped cause to identify whether the signature algorithm or key type is unsupported","Re-issue the certificate with an ECDSA (or supported RSA) signature algorithm","Ensure the BCCSP configuration (mspConfigPath / bccsp section) matches the certificate types in use","Upgrade Fabric to a version supporting the certificate's algorithm"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"block, _ := pem.Decode(certRaw)\ncert, err := x509.ParseCertificate(block.Bytes)\nif err == nil {\n    fmt.Println(cert.PublicKeyAlgorithm, cert.SignatureAlgorithm) // confirm supported\n}","typeGuard":"func isSupportedSignature(alg x509.SignatureAlgorithm) bool {\n    switch alg {\n    case x509.ECDSAWithSHA256, x509.ECDSAWithSHA384, x509.ECDSAWithSHA512, x509.SHA256WithRSA, x509.SHA384WithRSA, x509.SHA512WithRSA:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := mspSetup(...); err != nil {\n    if strings.Contains(err.Error(), \"sanitizeCert failed\") {\n        // re-issue certs with supported algorithms or adjust BCCSP config\n    }\n}","preventionTips":["Issue all certificates with ECDSA P-256 or standard RSA SHA-2 algorithms","Keep BCCSP configuration consistent across the network","Test certificates against the target Fabric version before rollout"],"tags":["x509","certificate-sanitization","bccsp","hyperledger-fabric"],"backgroundTag":"unsupported-certificate-algorithm","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}