{"record":{"id":"f2ac2ecb0f0c4261","repo":"hyperledger/fabric","slug":"expected-at-least-one-ca-certificate","errorCode":null,"errorMessage":"expected at least one CA certificate","messagePattern":"expected at least one CA certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"msp/mspimplsetup.go","lineNumber":110,"sourceCode":"\tif msp.cryptoConfig.SignatureHashFamily == \"\" {\n\t\tmsp.cryptoConfig.SignatureHashFamily = bccsp.SHA2\n\t\tmspLogger.Debugf(\"CryptoConfig.SignatureHashFamily was nil. Move to defaults.\")\n\t}\n\tif msp.cryptoConfig.IdentityIdentifierHashFunction == \"\" {\n\t\tmsp.cryptoConfig.IdentityIdentifierHashFunction = bccsp.SHA256\n\t\tmspLogger.Debugf(\"CryptoConfig.IdentityIdentifierHashFunction was nil. Move to defaults.\")\n\t}\n\n\tmsp.supportedPublicKeyAlgorithms = make(map[x509.PublicKeyAlgorithm]bool)\n\tmsp.supportedPublicKeyAlgorithms[x509.ECDSA] = true\n\n\treturn nil\n}\n\nfunc (msp *bccspmsp) setupCAs(conf *m.FabricMSPConfig) error {\n\t// make and fill the set of CA certs - we expect them to be there\n\tif len(conf.RootCerts) == 0 {\n\t\treturn errors.New(\"expected at least one CA certificate\")\n\t}\n\n\t// pre-create the verify options with roots and intermediates.\n\t// This is needed to make certificate sanitation working.\n\t// Recall that sanitization is applied also to root CA and intermediate\n\t// CA certificates. After their sanitization is done, the opts\n\t// will be recreated using the sanitized certs.\n\tmsp.opts = &x509.VerifyOptions{Roots: x509.NewCertPool(), Intermediates: x509.NewCertPool()}\n\tfor _, v := range conf.RootCerts {\n\t\tcert, err := msp.getCertFromPem(v)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tmsp.opts.Roots.AddCert(cert)\n\t}\n\tfor _, v := range conf.IntermediateCerts {\n\t\tcert, err := msp.getCertFromPem(v)\n\t\tif err != nil {","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplsetup.go#L92-L128","documentation":"setupCAs validation guard: the FabricMSPConfig provided no CA certificates at all (both RootCAs and IntermediateCAs empty after unmarshalling), so the MSP has no trust anchors to initialize and cannot be set up.","triggerScenarios":"FabricMSPConfig.RootCerts is an empty array — e.g. the cacerts directory referenced by the MSP config is empty, or the MSP config was generated/loaded without any CA certificates.","commonSituations":"MSP directory with empty cacerts/ folder; hand-edited config that dropped root certs; misconfigured path so the loader found no PEM files; partial copy of the MSP folder.","solutions":["Place the organization's root CA certificate(s) in the MSP cacerts/ directory","Regenerate the MSP folder (cryptogen generate / fabric-ca-client enroll+getcacerts)","Verify the mspConfigPath points to the directory actually containing cacerts","Check that the CA certificates are valid PEM files"],"exampleFix":"// before\n// msp/\n//   cacerts/          (empty)\n// after\n// msp/\n//   cacerts/\n//     ca-org1.pem     (root CA cert present)\nnull","handlingStrategy":"validation","validationCode":"if len(conf.RootCerts) == 0 {\n    return errors.New(\"MSP config has no root CA certificates; populate cacerts/ first\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check cacerts/ is non-empty before starting a peer/orderer with a new MSP","Never deploy MSP folders copied without their cacerts content","Generate MSPs with cryptogen or fabric-ca rather than by hand"],"tags":["msp-setup","missing-certificate","ca-certificate","hyperledger-fabric"],"backgroundTag":"missing-ca-certificate","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}