hyperledger/fabric · error

authorityKeyIdentifier not found in certificate

Error message

authorityKeyIdentifier not found in certificate

What it means

The CRL supplied to the MSP does not contain an Authority Key Identifier extension (OID 2.5.29.35), so getAuthorityKeyIdentifierFromCrl cannot determine which CA issued the revoked certificates and returns this error. Fabric requires the AKI to correlate the CRL with the CA in the validation chain.

Source

Thrown at msp/mspimplvalidate.go:349

// for the supplied CRL. The authority key identifier can be used to identify
// the public key corresponding to the private key which was used to sign the CRL.
func getAuthorityKeyIdentifierFromCrl(crl *pkix.CertificateList) ([]byte, error) {
	aki := authorityKeyIdentifier{}

	for _, ext := range crl.TBSCertList.Extensions {
		// Authority Key Identifier is identified by the following ASN.1 tag
		// authorityKeyIdentifier (2 5 29 35) (see https://tools.ietf.org/html/rfc3280.html)
		if reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 35}) {
			_, err := asn1.Unmarshal(ext.Value, &aki)
			if err != nil {
				return nil, errors.Wrap(err, "failed to unmarshal AKI")
			}

			return aki.KeyIdentifier, nil
		}
	}

	return nil, errors.New("authorityKeyIdentifier not found in certificate")
}

// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate
// Subject Key Identifier is an identifier of the public key of this certificate
func getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {
	var SKI []byte

	for _, ext := range cert.Extensions {
		// Subject Key Identifier is identified by the following ASN.1 tag
		// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)
		if reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {
			_, err := asn1.Unmarshal(ext.Value, &SKI)
			if err != nil {
				return nil, errors.Wrap(err, "failed to unmarshal Subject Key Identifier")
			}

			return SKI, nil
		}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate the CRL with AKI included: in openssl.cnf set crl_extensions = crl_ext and in [crl_ext] authorityKeyIdentifier=keyid:always
2. Issue the CRL from a CA whose configuration includes the AKI extension
3. Use fabric-ca to generate revocation lists, which include the AKI extension

Example fix

# before: openssl.cnf CA default section lacks CRL extensions
# after
[ ca ]
crl_extensions = crl_ext
[ crl_ext ]
authorityKeyIdentifier = keyid:always

import ("encoding/pem"; "crypto/x509")
func crlHasAKI(crlPEM []byte) bool {
    blk, _ := pem.Decode(crlPEM)
    if blk == nil { return false }
    crl, err := x509.ParseRevocationList(blk.Bytes)
    if err != nil { return false }
    return len(crl.AuthorityKeyId) > 0
}
// Return false -> Fabric will reject the CRL; regenerate with AKI extension.

When it happens

Trigger: validateCertAgainstChain iterates crl.TBSCertList.Extensions and finds no extension equal to asn1.ObjectIdentifier{2,5,29,35}; getAuthorityKeyIdentifierFromCrl returns errors.New("authorityKeyIdentifier not found in certificate").

Common situations: CRL generated without the crl_extensions option (openssl cnf missing 'crl_extensions = crl_ext' and 'authorityKeyIdentifier=keyid:always'); minimal CRLs from custom tooling; very old CRL formats.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• An X509 certificate with Basic Constraint: Certificate Autho
• the supplied identity has no verify options
• this MSP only supports a single validation chain, got %d
• expected a chain of length at least 2, got %d
• invalid validation chain. Parent certificate should be a lea

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/157ca4d6354d2aca. Report an issue: GitHub.