hyperledger/fabric · error

could not load signing certificate from directory %s

Error message

could not load signing certificate from directory %s

What it means

GetLocalMspConfig assembles the local (node) MSP config and needs at least one signing certificate from <msp-dir>/signcerts. This error wraps a getPemMaterialFromDir failure (unreadable dir or a bad PEM file inside it) with the signcerts path.

Source

Thrown at msp/configbuilder.go:181

		return idemix.GetIdemixMspConfig(dir, ID)
	default:
		return nil, errors.Errorf("unknown MSP type '%s'", mspType)
	}
}

func GetLocalMspConfig(dir string, bccspConfig *factory.FactoryOpts, ID string) (*msp.MSPConfig, error) {
	signcertDir := filepath.Join(dir, signcerts)
	keystoreDir := filepath.Join(dir, keystore)
	bccspConfig = SetupBCCSPKeystoreConfig(bccspConfig, keystoreDir)

	err := factory.InitFactories(bccspConfig)
	if err != nil {
		return nil, errors.WithMessage(err, "could not initialize BCCSP Factories")
	}

	signcert, err := getPemMaterialFromDir(signcertDir)
	if err != nil {
		return nil, errors.Wrapf(err, "could not load signing certificate from directory %s", signcertDir)
	} else if len(signcert) == 0 {
		return nil, errors.Errorf("no signing certificate found in directory %s", signcertDir)
	}

	/* FIXME: for now we're making the following assumptions
	1) there is exactly one signing cert
	2) BCCSP's KeyStore has the private key that matches SKI of
	   signing cert
	*/

	sigid := &msp.SigningIdentityInfo{PublicSigner: signcert[0], PrivateSigner: nil}

	return getMspConfig(dir, ID, sigid)
}

// GetVerifyingMspConfig returns an MSP config given directory, ID and type
func GetVerifyingMspConfig(dir, ID, mspType string) (*msp.MSPConfig, error) {
	switch mspType {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure <msp-dir>/signcerts contains a readable PEM signing cert and the dir is accessible
2. Fix the file/dir permissions reported by the wrapped error
3. Regenerate the local MSP with cryptogen generate or fabric-ca enroll to restore signcerts
4. Validate the cert: 'openssl x509 -in signcerts/*.pem -noout'

Example fix

// before: empty MSP without signcerts
GetLocalMspConfig("/tmp/msp-empty", ...) // error
// after
// cp admincerts/peer.pem /tmp/msp/signcerts/peer-signed.pem
GetLocalMspConfig("/tmp/msp", ...)

func signingCertPresent(root string) error {
    dir := filepath.Join(root, "signcerts")
    entries, err := os.ReadDir(dir)
    if err != nil { return err }
    for _, e := range entries {
        b, err := os.ReadFile(filepath.Join(dir, e.Name()))
        if err != nil { return err }
        if pem.Decode(b) != nil { return nil }
    }
    return fmt.Errorf("no valid PEM signing cert in %s", dir)
}

if err := InitCrypto(bsp, mspPath, id); err != nil {
    if strings.Contains(err.Error(), "could not load signing certificate") {
        return fmt.Errorf("fix %s/signcerts: unreadable or invalid PEM", filepath.Join(mspPath, "signcerts"))
    }
    return err
}

When it happens

Trigger: Calling GetLocalMspConfig/GetLocalMspConfigWithType (e.g. via InitCrypto) where the signcerts directory cannot be read, contains an unreadable/non-PEM file, or a symlink error occurs while loading it.

Common situations: MSP dir missing the signcerts folder, wrong CORE_PEER_MSPCONFIGPATH, permission problems, a corrupted PEM inside signcerts causing readPemFile to fail, container not mounting the cert volume.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• cannot init crypto, specified path "%s" does not exist or ca
• cannot init crypto, specified path "%s" is not a directory
• could not read file %s
• could not read directory %s
• no signing certificate found in directory %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/0ab7aebced4459ec. Report an issue: GitHub.