hyperledger/fabric · error

broadcast client identity expired

Error message

broadcast client identity expired

What it means

The broadcast client's x509 identity has an expiry timestamp (ExpiresAt) that is in the past. When orderer capabilities enable expiration checking, the msgprocessor rejects any transaction submitted with an expired certificate so stale members cannot keep broadcasting.

Source

Thrown at orderer/common/msgprocessor/expiration.go:53

// Apply checks whether the identity that created the envelope has expired
func (exp *expirationRejectRule) Apply(message *common.Envelope) error {
	ordererConf, ok := exp.filterSupport.OrdererConfig()
	if !ok {
		logger.Panic("Programming error: orderer config not found")
	}
	if !ordererConf.Capabilities().ExpirationCheck() {
		return nil
	}
	signedData, err := protoutil.EnvelopeAsSignedData(message)
	if err != nil {
		return errors.Errorf("could not convert message to signedData: %s", err)
	}
	expirationTime := crypto.ExpiresAt(signedData[0].Identity)
	// Identity cannot expire, or identity has not expired yet
	if expirationTime.IsZero() || time.Now().Before(expirationTime) {
		return nil
	}
	return errors.New("broadcast client identity expired")
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Renew the client certificate from the CA (fabric-ca-client reenroll) and update the wallet/MSP used to sign, then resubmit.
2. Update the organization's MSP on the channel with the new signer cert if the identity itself was replaced (config update).
3. Audit and automate cert rotation so identities are refreshed before ExpiresAt; alert on upcoming expiries.
4. If the whole org's cert expired, perform an MSP/config-block rotation following Fabric's expired-certificate playbook.

cert := loadedClientCert
if time.Now().After(cert.NotAfter) { return errors.New("client certificate expired; reenroll before broadcasting") }

if err := broadcast.Send(env); err != nil && strings.Contains(err.Error(), "broadcast client identity expired") { reenroll cert, update wallet/MSP, retry }

When it happens

Trigger: Apply on the expiration rule: crypto.ExpiresAt(signedData[0].Identity) is non-zero and time.Now() is after it — a client signed and submitted an envelope using credentials whose notAfter date has passed.

Common situations: Long-running client applications or SDK wallets still using certificates that expired since issuance; expired admin certs in a CI pipeline; nodes not rotating MSP certificates before expiry; clock skew is rarely the cause (expiry is genuinely passed).

Related errors

• collection-name: %s -- contains an identity that is not part
• Failed verifying that proposal's creator satisfies local MSP
• failed deserializing identity
• Cannot create signed proposal, due to %s
• failed to serialize signer

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b66ce6194ffed15f. Report an issue: GitHub.