{"record":{"id":"ee70daec03ef8bf7","repo":"hyperledger/fabric","slug":"could-not-sign-the-proposal-response-payload","errorCode":null,"errorMessage":"could not sign the proposal response payload","messagePattern":"could not sign the proposal response payload","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/handlers/endorsement/builtin/default_endorsement.go","lineNumber":49,"sourceCode":"// Returns:\n// The Endorsement: A signature over the payload, and an identity that is used to verify the signature\n// The payload that was given as input (could be modified within this function)\n// Or error on failure\nfunc (e *DefaultEndorsement) Endorse(prpBytes []byte, sp *peer.SignedProposal) (*peer.Endorsement, []byte, error) {\n\tsigner, err := e.SigningIdentityForRequest(sp)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"failed fetching signing identity\")\n\t}\n\t// serialize the signing identity\n\tidentityBytes, err := signer.Serialize()\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrapf(err, \"could not serialize the signing identity\")\n\t}\n\n\t// sign the concatenation of the proposal response and the serialized endorser identity with this endorser's key\n\tsignature, err := signer.Sign(append(prpBytes, identityBytes...))\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrapf(err, \"could not sign the proposal response payload\")\n\t}\n\tendorsement := &peer.Endorsement{Signature: signature, Endorser: identityBytes}\n\treturn endorsement, prpBytes, nil\n}\n\n// Init injects dependencies into the instance of the Plugin\nfunc (e *DefaultEndorsement) Init(dependencies ...endorsement.Dependency) error {\n\tfor _, dep := range dependencies {\n\t\tsIDFetcher, isSigningIdentityFetcher := dep.(identities.SigningIdentityFetcher)\n\t\tif !isSigningIdentityFetcher {\n\t\t\tcontinue\n\t\t}\n\t\te.SigningIdentityFetcher = sIDFetcher\n\t\treturn nil\n\t}\n\treturn errors.New(\"could not find SigningIdentityFetcher in dependencies\")\n}\n","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/handlers/endorsement/builtin/default_endorsement.go#L31-L67","documentation":"The default endorsement plugin signs the concatenation of the proposal response payload (prpBytes) and the serialized endorser identity using the signer's private key. This error wraps a failure from signer.Sign(), meaning the underlying BCCSP crypto layer could not produce the ECDSA signature.","triggerScenarios":"DefaultEndorsement.Endorse calls signer.Sign(append(prpBytes, identityBytes...)) and the signing operation fails — e.g. the private key cannot be accessed, the keystore is unreadable, or an HSM/PKCS#11 operation returns an error.","commonSituations":"Peer's keystore file deleted or permissions changed after start; PKCS#11 HSM session/token failure or wrong slot/pin configured in BCCSP; key migrated between software and HSM so the referenced private key no longer exists.","solutions":["Check the wrapped error in the peer log to confirm whether the keystore or HSM is the cause","Ensure peer.mspConfigPath keystore contains the private key matching signcerts, with correct file permissions for the peer user","Validate BCCSP PKCS#11 settings (library, label, pin, slot) against the actual HSM configuration","Restart the peer after restoring or regenerating crypto material"],"exampleFix":"// before: keystore missing after volume remount\n//   could not sign the proposal response payload: ... no such file: keystore/*_sk\n// after: restore key material matching the signing cert\n// ls /var/hyperledger/msp/keystore  # must contain *_sk for the cert in signcerts\n// chown -R peer:peer /var/hyperledger/msp && docker restart peer0.org1.example.com","handlingStrategy":"validation","validationCode":"// confirm key material exists and is readable before endorsing\nmatches, _ := filepath.Glob(filepath.Join(mspPath, \"keystore\", \"*_sk\"))\nif len(matches) == 0 { return errors.New(\"no private key in keystore\") }","typeGuard":null,"tryCatchPattern":"sig, err := signer.Sign(payload)\nif err != nil {\n    logger.Errorf(\"endorsement signing failed (check keystore/HSM): %v\", err)\n    return nil, status.Error(codes.Internal, \"endorsement signing unavailable\")\n}","preventionTips":["Backup the keystore alongside signcerts and verify they match","Test HSM connectivity (login/sign) as part of peer startup health checks","Avoid rotating HSM pins without updating BCCSP config","Watch peer logs for BCCSP errors proactively"],"tags":["fabric","endorsement","signing","bccsp","private-key"],"backgroundTag":"signing-operation-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}