{"record":{"id":"f04428ab9923840a","repo":"hyperledger/fabric","slug":"failed-to-compare-cert-public-keys","errorCode":null,"errorMessage":"failed to compare cert public keys","messagePattern":"failed to compare cert public keys","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"orderer/common/cluster/clusterservice.go","lineNumber":168,"sourceCode":"\n\tmembership := s.MembershipByChannel[authReq.Channel]\n\tif membership == nil {\n\t\treturn nil, errors.Errorf(\"channel %s not found in config\", authReq.Channel)\n\t}\n\n\tfromIdentity := membership.MemberMapping[authReq.FromId]\n\tif fromIdentity == nil {\n\t\treturn nil, errors.Errorf(\"node %d is not member of channel %s\", authReq.FromId, authReq.Channel)\n\t}\n\n\ttoIdentity := membership.MemberMapping[authReq.ToId]\n\tif toIdentity == nil {\n\t\treturn nil, errors.Errorf(\"node %d is not member of channel %s\", authReq.ToId, authReq.Channel)\n\t}\n\n\tequal, err := CompareCertPublicKeys(toIdentity, s.NodeIdentity)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"failed to compare cert public keys\")\n\t}\n\tif !equal {\n\t\ts.Logger.Debugf(\"node id mismatch for node %d, toIdentity: %s, s.NodeIdentity: %s\", authReq.FromId, string(toIdentity), string(s.NodeIdentity))\n\t\treturn nil, errors.Errorf(\"node id mismatch\")\n\t}\n\n\terr = VerifySignature(fromIdentity, SHA256Digest(msg), authReq.Signature)\n\tif err != nil {\n\t\treturn nil, errors.Wrap(err, \"signature mismatch\")\n\t}\n\n\treturn authReq, nil\n}\n\nfunc (s *ClusterService) handleMessage(stream ClusterStepStream, addr string, exp *certificateExpirationCheck, channel string, sender uint64, streamID uint64) error {\n\trequest, err := stream.Recv()\n\tif err == io.EOF {\n\t\treturn err","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/orderer/common/cluster/clusterservice.go#L150-L186","documentation":"VerifyAuthRequest wraps a failure of CompareCertPublicKeys comparing the ToId consenter's certificate with this node's own NodeIdentity. The comparison itself errored (e.g. unparsable public keys) rather than simply mismatching, so the request cannot be authenticated as targeted at this node.","triggerScenarios":"Thrown at orderer/common/cluster/clusterservice.go:168 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the ToId consenter's certificate and this node's cluster TLS certificate are valid X.509 certs","Reconcile the channel config's consenter certificates with the deployed TLS certificates"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}