{"record":{"id":"ef9c1b91396a332c","repo":"hyperledger/fabric","slug":"failed-to-create-x509-verify-options-from-orderer","errorCode":null,"errorMessage":"failed to create x509 verify options from orderer config","messagePattern":"failed to create x509 verify options from orderer config","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/consensus/etcdraft/consenter.go","lineNumber":253,"sourceCode":"\tif err != nil {\n\t\treturn false, err\n\t}\n\tbundle, err := channelconfig.NewBundleFromEnvelope(envelopeConfig, c.BCCSP)\n\tif err != nil {\n\t\treturn false, err\n\t}\n\toc, exists := bundle.OrdererConfig()\n\tif !exists {\n\t\treturn false, errors.New(\"no orderer config in bundle\")\n\t}\n\tconfigMetadata := &etcdraft.ConfigMetadata{}\n\tif err := proto.Unmarshal(oc.ConsensusMetadata(), configMetadata); err != nil {\n\t\treturn false, err\n\t}\n\n\tverifyOpts, err := createX509VerifyOptions(oc)\n\tif err != nil {\n\t\treturn false, errors.Wrapf(err, \"failed to create x509 verify options from orderer config\")\n\t}\n\n\tif err := VerifyConfigMetadata(configMetadata, verifyOpts); err != nil {\n\t\treturn false, errors.Wrapf(err, \"failed to validate config metadata of ordering config\")\n\t}\n\n\tconsenters := make(map[uint64]*etcdraft.Consenter)\n\tfor i, c := range configMetadata.GetConsenters() {\n\t\tconsenters[uint64(i+1)] = c // the IDs don't matter\n\t}\n\n\tif _, err := c.detectSelfID(consenters); err != nil {\n\t\tif err != cluster.ErrNotInChannel {\n\t\t\treturn false, errors.Wrapf(err, \"failed to detect self ID by comparing public keys\")\n\t\t}\n\t\treturn false, nil\n\t}\n","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/consensus/etcdraft/consenter.go#L235-L271","documentation":"Consenter.IsChannelMember wraps a failure of createX509VerifyOptions(oc): x509 verify options (root CA pool and intermediates) could not be constructed from the orderer config's certificates, so consenter TLS certificates cannot be verified.","triggerScenarios":"Thrown at orderer/consensus/etcdraft/consenter.go:253 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check that all consenters' TLS certificates in the channel config are valid X.509 certs","Re-add properly issued TLS certificates for the consenters"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}