hyperledger/fabric · error

An X509 certificate with Basic Constraint: Certificate Autho

Error message

An X509 certificate with Basic Constraint: Certificate Authority equals true cannot be used as an identity

What it means

This MSP implementation refuses any identity whose X.509 certificate has BasicConstraints CA=true. CA certificates define trust; they are never valid end-entity identities, so using one as an identity would let a CA impersonate arbitrary peers. getCertificationChainForBCCSPIdentity rejects the cert before building its validation chain.

Source

Thrown at msp/mspimpl.go:719

	default:
		return nil, errors.New("identity type not recognized")
	}
}

// getCertificationChainForBCCSPIdentity returns the certification chain of the passed bccsp identity within this msp
func (msp *bccspmsp) getCertificationChainForBCCSPIdentity(id *identity) ([]*x509.Certificate, error) {
	if id == nil {
		return nil, errors.New("Invalid bccsp identity. Must be different from nil.")
	}

	// we expect to have a valid VerifyOptions instance
	if msp.opts == nil {
		return nil, errors.New("Invalid msp instance")
	}

	// CAs cannot be directly used as identities..
	if id.cert.IsCA {
		return nil, errors.New("An X509 certificate with Basic Constraint: " +
			"Certificate Authority equals true cannot be used as an identity")
	}

	return msp.getValidationChain(id.cert, false)
}

func (msp *bccspmsp) getUniqueValidationChain(cert *x509.Certificate, opts x509.VerifyOptions) ([]*x509.Certificate, error) {
	// ask golang to validate the cert for us based on the options that we've built at setup time
	if msp.opts == nil {
		return nil, errors.New("the supplied identity has no verify options")
	}
	validationChains, err := cert.Verify(opts)
	if err != nil {
		return nil, errors.WithMessage(err, "the supplied identity is not valid")
	}

	// we only support a single validation chain;
	// if there's more than one then there might

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Use the end-entity certificate from the MSP signcerts directory (or the issued client cert from fabric-ca enroll), not ca-cert.pem
2. Verify the cert's BasicConstraints before use: reject any cert with IsCA=true
3. Re-enroll the identity with fabric-ca-client enroll to obtain a proper non-CA certificate
4. If an intermediate CA chain is needed, provide the intermediate certs in the MSP intermediatescerts folder, not as the identity

Example fix

// before
ident, _ := msp.SerializeSigningIdentity(orgCACert.Raw, signerKey)
// after
ident, _ := msp.SerializeSigningIdentity(clientEndEntityCert.Raw, signerKey)

func isCA(cert *x509.Certificate) bool { return cert.IsCA }
if isCA(clientCert) { return errors.New("CA cert cannot be used as identity") }

func isEndEntity(cert *x509.Certificate) bool {
	return cert != nil && !cert.IsCA && cert.KeyUsage&x509.KeyUsageCertSign == 0
}

When it happens

Trigger: Calling validateIdentity (or getCertificationChain via getCertificationChainForBCCSPIdentity) with an identity serialized from a CA certificate (id.cert.IsCA true), e.g. enrolling with or registering the fabric-ca server's or root CA's cert as the client identity.

Common situations: Developers copy the wrong PEM from a crypto-config tree: they grab ca-cert.pem or the intermediate CA cert instead of the signcerts/ endpoint certificate; or they misconfigure an SDK to use the org CA cert as the user's signing identity.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• the supplied identity has no verify options
• this MSP only supports a single validation chain, got %d
• expected a chain of length at least 2, got %d
• invalid validation chain. Parent certificate should be a lea
• failed to traverse certificate verification chain for leaf o

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d3ad8a622d40eca1. Report an issue: GitHub.