{"record":{"id":"e5fbbfefe1c58291","repo":"hyperledger/fabric","slug":"cannot-load-consenter-config-for-orderer-type-s","errorCode":null,"errorMessage":"cannot load consenter config for orderer type %s: %s","messagePattern":"cannot load consenter config for orderer type (.+?): (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configtxgen/encoder/encoder.go","lineNumber":221,"sourceCode":"\taddValue(ordererGroup, channelconfig.ChannelRestrictionsValue(conf.MaxChannels), channelconfig.AdminsPolicyKey)\n\n\tif len(conf.Capabilities) > 0 {\n\t\taddValue(ordererGroup, channelconfig.CapabilitiesValue(conf.Capabilities), channelconfig.AdminsPolicyKey)\n\t}\n\n\tvar consensusMetadata []byte\n\tvar err error\n\n\tswitch conf.OrdererType {\n\tcase ConsensusTypeSolo:\n\tcase ConsensusTypeEtcdRaft:\n\t\tif consensusMetadata, err = channelconfig.MarshalEtcdRaftMetadata(conf.EtcdRaft); err != nil {\n\t\t\treturn nil, errors.Errorf(\"cannot marshal metadata for orderer type %s: %s\", ConsensusTypeEtcdRaft, err)\n\t\t}\n\tcase ConsensusTypeBFT:\n\t\tconsenterProtos, err := consenterProtosFromConfig(conf.ConsenterMapping)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Errorf(\"cannot load consenter config for orderer type %s: %s\", ConsensusTypeBFT, err)\n\t\t}\n\t\taddValue(ordererGroup, channelconfig.OrderersValue(consenterProtos), channelconfig.AdminsPolicyKey)\n\t\tif consensusMetadata, err = channelconfig.MarshalBFTOptions(conf.SmartBFT); err != nil {\n\t\t\treturn nil, errors.Errorf(\"consenter options read failed with error %s for orderer type %s\", err, ConsensusTypeBFT)\n\t\t}\n\t\t// Force leader rotation to be turned off\n\t\tconf.SmartBFT.LeaderRotation = smartbft.Options_ROTATION_OFF\n\t\t// Overwrite policy manually by computing it from the consenters\n\t\tpolicies.EncodeBFTBlockVerificationPolicy(consenterProtos, ordererGroup)\n\tdefault:\n\t\treturn nil, errors.Errorf(\"unknown orderer type: %s\", conf.OrdererType)\n\t}\n\n\taddValue(ordererGroup, channelconfig.ConsensusTypeValue(conf.OrdererType, consensusMetadata), channelconfig.AdminsPolicyKey)\n\n\tfor _, org := range conf.Organizations {\n\t\tvar err error\n\t\tordererGroup.Groups[org.Name], err = NewOrdererOrgGroup(org, channelCapabilities)","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/internal/configtxgen/encoder/encoder.go#L203-L239","documentation":"For BFT orderers, NewOrdererGroup converts conf.ConsenterMapping into consenter protobufs via consenterProtosFromConfig. Failure there (bad host/port, unreadable cert/identity files) is wrapped as 'cannot load consenter config for orderer type BFT'. It stops the config group from being built before the Orderers value and BFT metadata are added.","triggerScenarios":"NewOrdererGroup with OrdererType \"BFT\" where consenterProtosFromConfig returns an error: a ConsenterMapping entry has an invalid address or a ClientTLSCert/ServerTLSCert/Identity path that cannot be read/parsed.","commonSituations":"Migrating a profile from etcdraft to BFT: consenter entries reference cert files that were never generated, wrong relative paths when running configtxgen from another directory, or malformed host/port strings.","solutions":["Inspect the wrapped underlying error — it names the failing consenter host:port and cause","Verify each ConsenterMapping entry's Identity/ClientTLSCert/ServerTLSCert files exist and are valid PEM","Run configtxgen from the directory where relative cert paths resolve, or use absolute paths","Check Host/Port are non-empty and numeric where required"],"exampleFix":"# before\nConsenterMapping:\n    - Identity: crypto/badpath/id.pem\n      Host: orderer.example.com\n      Port: 7050\n# after\nConsenterMapping:\n    - Identity: crypto-config/ordererOrganizations/example.com/orderers/orderer.example.com/msp/signcerts/orderer-example-com-cert.pem\n      ClientTLSCert: crypto-config/.../tls/server.crt\n      ServerTLSCert: crypto-config/.../tls/server.crt\n      Host: orderer.example.com\n      Port: 7050","handlingStrategy":"validation","validationCode":"func validateBFTConsenters(conf *genesisconfig.Orderer) error {\n    for _, c := range conf.ConsenterMapping {\n        for _, p := range []string{c.Identity, c.ClientTLSCert, c.ServerTLSCert} {\n            if p != \"\" {\n                if _, err := os.ReadFile(p); err != nil { return fmt.Errorf(\"consenter %s:%d: %w\", c.Host, c.Port, err) }\n            }\n        }\n        if c.Host == \"\" || c.Port == 0 { return fmt.Errorf(\"consenter host/port invalid\") }\n    }\n    return nil\n}","typeGuard":"func hasBFTConsenterMapping(conf *genesisconfig.Orderer) bool { return conf.OrdererType == \"BFT\" && len(conf.ConsenterMapping) > 0 }","tryCatchPattern":"group, err := encoder.NewOrdererGroup(conf, caps)\nif err != nil && strings.Contains(err.Error(), \"cannot load consenter config\") {\n    return fmt.Errorf(\"check ConsenterMapping cert/identity paths: %w\", err)\n}","preventionTips":["Pre-generate all consenter certs before running configtxgen","Use absolute cert paths in CI/container environments","Verify each ConsenterMapping entry has Host, Port, Identity, and both TLS certs populated"],"tags":["config","hyperledger-fabric","bft","tls"],"backgroundTag":"consenter-cert-load-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}