{"record":{"id":"f768ceecf54faf9a","repo":"hyperledger/fabric","slug":"invalid-validation-chain-parent-certificate-shoul","errorCode":null,"errorMessage":"invalid validation chain. Parent certificate should be a leaf of the certification tree [%v]","messagePattern":"invalid validation chain\\. Parent certificate should be a leaf of the certification tree \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimpl.go","lineNumber":862,"sourceCode":"func (msp *bccspmsp) getValidationChain(cert *x509.Certificate, isIntermediateChain bool) ([]*x509.Certificate, error) {\n\tvalidationChain, err := msp.getUniqueValidationChain(cert, msp.getValidityOptsForCert(cert))\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"failed getting validation chain\")\n\t}\n\n\t// we expect a chain of length at least 2\n\tif len(validationChain) < 2 {\n\t\treturn nil, errors.Errorf(\"expected a chain of length at least 2, got %d\", len(validationChain))\n\t}\n\n\t// check that the parent is a leaf of the certification tree\n\t// if validating an intermediate chain, the first certificate will the parent\n\tparentPosition := 1\n\tif isIntermediateChain {\n\t\tparentPosition = 0\n\t}\n\tif msp.certificationTreeInternalNodesMap[string(validationChain[parentPosition].Raw)] {\n\t\treturn nil, errors.Errorf(\"invalid validation chain. Parent certificate should be a leaf of the certification tree [%v]\", cert.Raw)\n\t}\n\treturn validationChain, nil\n}\n\n// getCertificationChainIdentifier returns the certification chain identifier of the passed identity within this msp.\n// The identifier is computes as the SHA256 of the concatenation of the certificates in the chain.\nfunc (msp *bccspmsp) getCertificationChainIdentifier(id Identity) ([]byte, error) {\n\tchain, err := msp.getCertificationChain(id)\n\tif err != nil {\n\t\treturn nil, errors.WithMessagef(err, \"failed getting certification chain for [%v]\", id)\n\t}\n\n\t// chain[0] is the certificate representing the identity.\n\t// It will be discarded\n\treturn msp.getCertificationChainIdentifierFromChain(chain[1:])\n}\n\nfunc (msp *bccspmsp) getCertificationChainIdentifierFromChain(chain []*x509.Certificate) ([]byte, error) {","sourceCodeStart":844,"sourceCodeEnd":880,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimpl.go#L844-L880","documentation":"After validating the chain, getValidationChain checks that the parent certificate (chain[1], or chain[0] for intermediate chains) is a leaf of the certification tree, using certificationTreeInternalNodesMap populated at setup. If the parent is an internal (intermediate) node that is not properly registered as a certification-tree leaf parent, the chain layout doesn't match the MSP's configured CA hierarchy and validation is rejected.","triggerScenarios":"getCertificationChainForBCCSPIdentity or getCertifiersIdentifier validates an identity whose direct parent certificate's raw DER is present in certificationTreeInternalNodesMap — i.e. the immediate parent is an intermediate CA that the MSP recorded as an internal node rather than an acceptable chain parent, e.g. an identity issued directly by an intermediate that was configured as a root.","commonSituations":"MSP config lists an intermediate CA in cacerts so identities signed by it produce parents that map to internal nodes; mixing intermediatescerts/cacerts contents after migrating from an old org MSP; channel MSP differing from local MSP CA hierarchy.","solutions":["Put only true root CAs in cacerts and intermediate CAs in intermediatescerts so the parent of any chain is a leaf of the certification tree","Update the channel/local MSP configuration to match the actual issuing CA hierarchy","Re-issue identities from the CA whose chain layout matches the MSP configuration","Regenerate the MSP directory with cryptogen/fabric-ca after hierarchy changes"],"exampleFix":"// before\n// cacerts: [intermediateCA.pem]\n// after\n// cacerts: [rootCA.pem], intermediatescerts: [intermediateCA.pem]","handlingStrategy":"validation","validationCode":"// ensure parent of identity is a leaf CA in your hierarchy\nif cert.Issuer.Equal(intermediateCA.Subject) {\n\t// intermediateCA must be in intermediatescerts, root in cacerts\n}","typeGuard":null,"tryCatchPattern":"chain, err := msp.GetCertificationChain(id)\nif err != nil && strings.Contains(err.Error(), \"Parent certificate should be a leaf\") {\n\t// re-check MSP CA hierarchy configuration\n}","preventionTips":["Model the CA hierarchy before generating certs: roots in cacerts, intermediates in intermediatescerts","Keep channel MSP and local MSP hierarchies in sync","Test identity validation after any MSP reconfiguration in CI"],"tags":["x509","msp","fabric","trust-chain"],"backgroundTag":"invalid-certification-tree","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}