{"record":{"id":"fe1fbb6962fbd003","repo":"hyperledger/fabric","slug":"could-not-create-a-signed-deliver-seekinfo-message","errorCode":null,"errorMessage":"could not create a signed Deliver SeekInfo message, something is critically wrong","messagePattern":"could not create a signed Deliver SeekInfo message, something is critically wrong","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"common/deliverclient/blocksprovider/bft_censorship_monitor.go","lineNumber":398,"sourceCode":"\n// newHeaderClient connects to the orderer's delivery service and requests a stream of headers.\n// Seek from the largest of the block progress and the last good header from the previous header receiver.\nfunc (m *BFTCensorshipMonitor) newHeaderClient(endpoint *orderers.Endpoint, prevHeaderReceiver *BFTHeaderReceiver) (deliverClient orderer.AtomicBroadcast_DeliverClient, clientCloser func(), err error) {\n\tblockNumber, blockTime := m.progressReporter.BlockProgress()\n\tif !blockTime.IsZero() {\n\t\tblockNumber++ // If blockTime.IsZero(), we request block number 0, else blockNumber+1\n\t}\n\n\tif prevHeaderReceiver != nil {\n\t\thNum, _, errH := prevHeaderReceiver.LastBlockNum()\n\t\tif errH == nil && (hNum+1) > blockNumber {\n\t\t\tblockNumber = hNum + 1\n\t\t}\n\t}\n\n\tseekInfoEnv, err := m.requester.SeekInfoHeadersFrom(blockNumber)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"could not create a signed Deliver SeekInfo message, something is critically wrong\")\n\t}\n\n\tdeliverClient, clientCloser, err = m.requester.Connect(seekInfoEnv, endpoint)\n\tif err != nil {\n\t\treturn nil, nil, errors.Wrap(err, \"could not connect to ordering service\")\n\t}\n\n\treturn deliverClient, clientCloser, nil\n}\n","sourceCodeStart":380,"sourceCodeEnd":408,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/deliverclient/blocksprovider/bft_censorship_monitor.go#L380-L408","documentation":"newHeaderClient builds a signed SeekInfo envelope (requesting block headers starting at blockNumber) via m.requester.SeekInfoHeadersFrom before connecting to the orderer. If signing fails, the code wraps the error with this message because a failure to sign a locally constructed message indicates an internal/critical fault (e.g. missing signing identity) rather than a transient network issue.","triggerScenarios":"launchHeaderReceivers → newHeaderClient when requester.SeekInfoHeadersFrom(blockNumber) returns an error — typically the signer/identity context is missing or the crypto material cannot produce a signature for the SeekInfo envelope.","commonSituations":"Client identity/MSPEXPIRED or missing signer (crypto material not loaded); expired or unparseable certificates; requester constructed without a signing identity in tests; local MSP misconfiguration on the peer/client.","solutions":["Ensure the requester was created with a valid signing identity (local MSP / correct user context) before connecting.","Verify certificate/key files exist, are readable, and have not expired.","Recreate the signer/signing identity and retry SeekInfoHeadersFrom; inspect the wrapped inner error for the crypto cause.","If in tests, inject a functioning mock/signer into the requester so envelope signing can succeed."],"exampleFix":"// before\nrequester := &deliverclient.Requester{} // no signer set\nenv, err := requester.SeekInfoHeadersFrom(n) // wrapped: 'could not create a signed Deliver SeekInfo message'\n// after\nsigner, err := mspmgmt.GetLocalMSP().GetDefaultSigningIdentity()\nif err != nil {\n    return fmt.Errorf(\"no signing identity available: %w\", err)\n}\nrequester := deliverclient.NewRequester(channelID, csr, signer, ...)\nenv, err := requester.SeekInfoHeadersFrom(n)","handlingStrategy":"try-catch","validationCode":"if signer == nil {\n    return fmt.Errorf(\"no signing identity loaded; cannot build SeekInfo envelope\")\n}","typeGuard":null,"tryCatchPattern":"hdrCli, closer, err := monitor.newHeaderClient(ep)\nif err != nil {\n    if strings.Contains(err.Error(), \"could not create a signed Deliver SeekInfo message\") {\n        // crypto/identity fault: reload MSP/user context, then retry with backoff\n    }\n    return err\n}","preventionTips":["Verify the local MSP and signing identity load successfully at client startup.","Monitor certificate expiry and rotate credentials before they lapse.","Unwrap and log the inner error (errors.Cause) to identify the exact crypto failure.","In tests, always wire a real or mocked signer into the requester."],"tags":["fabric","deliver-client","signing","identity","bft-censorship-monitor"],"backgroundTag":"deliver-envelope-signing-failed","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}