{"record":{"id":"fd2add284ea8eeef","repo":"hyperledger/fabric","slug":"subjectkeyidentifier-not-found-in-certificate","errorCode":null,"errorMessage":"subjectKeyIdentifier not found in certificate","messagePattern":"subjectKeyIdentifier not found in certificate","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"msp/mspimplvalidate.go","lineNumber":370,"sourceCode":"// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate\n// Subject Key Identifier is an identifier of the public key of this certificate\nfunc getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {\n\tvar SKI []byte\n\n\tfor _, ext := range cert.Extensions {\n\t\t// Subject Key Identifier is identified by the following ASN.1 tag\n\t\t// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)\n\t\tif reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {\n\t\t\t_, err := asn1.Unmarshal(ext.Value, &SKI)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, errors.Wrap(err, \"failed to unmarshal Subject Key Identifier\")\n\t\t\t}\n\n\t\t\treturn SKI, nil\n\t\t}\n\t}\n\n\treturn nil, errors.New(\"subjectKeyIdentifier not found in certificate\")\n}\n","sourceCodeStart":352,"sourceCodeEnd":372,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/msp/mspimplvalidate.go#L352-L372","documentation":"The MSP X.509 validation code extracts the Subject Key Identifier (SKI, the subjectKeyIdentifier extension, OID 2.5.29.14) from a certificate to build/validate certificate chains. If the certificate carries no SKI extension, getSubjectKeyIdentifierFromCert returns this error and chain validation fails. Per RFC 5280 CA certificates should always have an SKI, so its absence indicates a malformed or non-compliant certificate.","triggerScenarios":"Calling finalizeSetupCAs, setupTLSCAs, or validateCertAgainstChain with a CA or intermediate certificate that lacks the subjectKeyIdentifier extension (e.g. certs generated by non-standard or very old tooling, or hand-crafted certs).","commonSituations":"Custom CA certificates generated without the SKI extension (openssl config missing subjectKeyIdentifier=hash), certs from legacy/proprietary CAs, or certificates edited/re-issued incorrectly; often surfaces when adding an org or TLS CA to the channel MSP.","solutions":["Regenerate the certificate with the subjectKeyIdentifier extension enabled (openssl x509 extensions: subjectKeyIdentifier=hash)","If regenerating, re-issue with standard tooling (cryptogen, Fabric CA, or cfssl) which include SKI by default","Verify the cert with `openssl x509 -in cert.pem -text` and check for 'Subject Key Identifier' before enrolling it in the MSP","If the cert comes from an external CA, request a compliant re-issuance per RFC 5280"],"exampleFix":"# before (openssl.cnf missing SKI)\n# basicConstraints = critical,CA:true\n# after\nbasicConstraints = critical,CA:true\nsubjectKeyIdentifier = hash\nauthorityKeyIdentifier = keyid:always,issuer","handlingStrategy":"validation","validationCode":"func hasSKI(cert *x509.Certificate) bool {\n\tfor _, oid := range cert.Extensions {\n\t\tif oid.Id.Equal(oidSubjectKeyIdentifier) { return true }\n\t}\n\treturn false\n}\n// reject CA certs where !hasSKI(cert) before adding them to the MSP","typeGuard":null,"tryCatchPattern":"if _, err := getSubjectKeyIdentifierFromCert(cert); err != nil {\n\treturn fmt.Errorf(\"certificate %s lacks subjectKeyIdentifier: regenerate with SKI\", cert.Subject)\n}","preventionTips":["Generate all CA certs with openssl/fabric-ca defaults which include subjectKeyIdentifier=hash","Inspect certs with `openssl x509 -text` for 'Subject Key Identifier' before installing into an MSP","Follow RFC 5280 profile in any custom CA tooling","Validate cert chains with a linter before channel config updates"],"tags":["x509","certificate","msp","tls"],"backgroundTag":"missing-certificate-extension","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}