{"record":{"id":"eee21bba8b80600b","repo":"hyperledger/fabric","slug":"no-signing-certificate-found-in-directory-s","errorCode":null,"errorMessage":"no signing certificate found in directory %s","messagePattern":"no signing certificate found in directory (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/configbuilder.go","lineNumber":183,"sourceCode":"\t\treturn nil, errors.Errorf(\"unknown MSP type '%s'\", mspType)\n\t}\n}\n\nfunc GetLocalMspConfig(dir string, bccspConfig *factory.FactoryOpts, ID string) (*msp.MSPConfig, error) {\n\tsigncertDir := filepath.Join(dir, signcerts)\n\tkeystoreDir := filepath.Join(dir, keystore)\n\tbccspConfig = SetupBCCSPKeystoreConfig(bccspConfig, keystoreDir)\n\n\terr := factory.InitFactories(bccspConfig)\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"could not initialize BCCSP Factories\")\n\t}\n\n\tsigncert, err := getPemMaterialFromDir(signcertDir)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"could not load signing certificate from directory %s\", signcertDir)\n\t} else if len(signcert) == 0 {\n\t\treturn nil, errors.Errorf(\"no signing certificate found in directory %s\", signcertDir)\n\t}\n\n\t/* FIXME: for now we're making the following assumptions\n\t1) there is exactly one signing cert\n\t2) BCCSP's KeyStore has the private key that matches SKI of\n\t   signing cert\n\t*/\n\n\tsigid := &msp.SigningIdentityInfo{PublicSigner: signcert[0], PrivateSigner: nil}\n\n\treturn getMspConfig(dir, ID, sigid)\n}\n\n// GetVerifyingMspConfig returns an MSP config given directory, ID and type\nfunc GetVerifyingMspConfig(dir, ID, mspType string) (*msp.MSPConfig, error) {\n\tswitch mspType {\n\tcase ProviderTypeToString(FABRIC):\n\t\treturn getMspConfig(dir, ID, nil)","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/configbuilder.go#L165-L201","documentation":"GetLocalMspConfig requires exactly the local node's signing certificate; this error means the signcerts directory was read successfully but contained zero PEM certificates. The node has no identity cert, so a local MSP cannot be constructed.","triggerScenarios":"Calling GetLocalMspConfig/GetLocalMspConfigWithType (via InitCrypto) against an MSP directory whose signcerts/ folder is empty — no cert has been enrolled/copied yet, or only a private key exists in keystore.","commonSituations":"Fresh fabric-ca enroll output mis-organized (cert left in keystore or copekeystore), MSP dir copied without signcerts, stale mounted volume wiped at container start, forgotten cryptogen step.","solutions":["Copy the signed node certificate into <msp-dir>/signcerts/ (e.g. from fabric-ca-client's Signcerts dir after enroll)","Re-run 'fabric-ca-client enroll' or 'cryptogen generate' to produce the signing cert","Verify signcerts is non-empty: 'ls <msp-dir>/signcerts/*.pem'","Check that Core peer.tls/cert config points to the correct MSP root"],"exampleFix":"// before: signcerts empty\n$ ls msp/signcerts   # (empty)\n// after\n$ cp msp/keystore/../Signcerts/cert.pem msp/signcerts/cert.pem\n$ ls msp/signcerts   # cert.pem","handlingStrategy":"validation","validationCode":"func hasSigningCert(mspRoot string) error {\n    files, err := filepath.Glob(filepath.Join(mspRoot, \"signcerts\", \"*.pem\"))\n    if err != nil { return err }\n    if len(files) == 0 {\n        return fmt.Errorf(\"%s/signcerts is empty: run fabric-ca-client enroll or cryptogen first\", mspRoot)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := InitCrypto(bsp, mspPath, mspID); err != nil {\n    if strings.Contains(err.Error(), \"no signing certificate found\") {\n        return fmt.Errorf(\"enroll node or copy cert into %s/signcerts\", mspPath)\n    }\n    return err\n}","preventionTips":["After 'fabric-ca-client enroll', copy the cert from Signcerts into msp/signcerts","Never ship an MSP directory without signcerts content","Check 'ls <msp>/signcerts/*.pem' in your deployment script before start","If certs are mounted into containers, verify the mount is not empty at startup"],"tags":["msp","signing-certificate","configuration"],"backgroundTag":"missing-signing-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}