What causes "could not read file %s" in hyperledger/fabric?

Verify the path exists: 'ls -l /signcerts /keystore' and fix CORE_PEER_MSPCONFIGPATH or the dir argument

could not read file %s

Error message

could not read file %s

What it means

readFile is the MSP config utility that loads a file from disk. This error is os.ReadFile's failure (typically ENOENT or EACCES) wrapped with the file path, meaning the MSP configuration references a file that does not exist or is unreadable.

Source

Thrown at msp/configbuilder.go:63

	// OrdererOUIdentifier specifies how to recognize admins by OU
	OrdererOUIdentifier *OrganizationalUnitIdentifiersConfiguration `yaml:"OrdererOUIdentifier,omitempty"`
}

// Configuration represents the accessory configuration an MSP can be equipped with.
// By default, this configuration is stored in a yaml file
type Configuration struct {
	// OrganizationalUnitIdentifiers is a list of OUs. If this is set, the MSP
	// will consider an identity valid only it contains at least one of these OUs
	OrganizationalUnitIdentifiers []*OrganizationalUnitIdentifiersConfiguration `yaml:"OrganizationalUnitIdentifiers,omitempty"`
	// NodeOUs enables the MSP to tell apart clients, peers and orderers based
	// on the identity's OU.
	NodeOUs *NodeOUs `yaml:"NodeOUs,omitempty"`
}

func readFile(file string) ([]byte, error) {
	fileCont, err := os.ReadFile(file)
	if err != nil {
		return nil, errors.Wrapf(err, "could not read file %s", file)
	}

	return fileCont, nil
}

func readPemFile(file string) ([]byte, error) {
	bytes, err := readFile(file)
	if err != nil {
		return nil, errors.Wrapf(err, "reading from file %s failed", file)
	}

	b, _ := pem.Decode(bytes)
	if b == nil { // TODO: also check that the type is what we expect (cert vs key..)
		return nil, errors.Errorf("no pem content for file %s", file)
	}

	return bytes, nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Verify the path exists: 'ls -l <msp-path>/signcerts <msp-path>/keystore' and fix CORE_PEER_MSPCONFIGPATH or the dir argument
Fix file permissions: 'chown -R <fabric-user> <msp-path>' or chmod 644/600 as appropriate
If running in Docker/K8s, confirm the MSP volume is mounted and the mount path matches the config
Re-generate the MSP directory with cryptogen or fabric-ca if material is missing

Example fix

// before
mspConfig, err := GetLocalMspConfig("/etc/hyperledger/fabric/msp-missing", bccsp, "Org1")
// after: verify directory first
if _, err := os.Stat("/etc/hyperledger/fabric/msp/signcerts"); err == nil {
    mspConfig, err = GetLocalMspConfig("/etc/hyperledger/fabric/msp", bccsp, "Org1")
}

Defensive patterns

Strategy: validation

Validate before calling

func fileReadable(path string) error {
    fi, err := os.Stat(path)
    if err != nil { return err }
    if fi.IsDir() { return fmt.Errorf("%s is a directory", path) }
    f, err := os.Open(path)
    if err != nil { return err }
    return f.Close()
}
// run on each file under <msp>/signcerts, cacerts, admincerts before InitCrypto

Try / catch

cert, err := loadCertificateAt(path, id, keystore)
if err != nil {
    var pe *fs.PathError
    if errors.As(err, &pe) && os.IsNotExist(err) {
        return fmt.Errorf("MSP file missing at %s: check CORE_PEER_MSPCONFIGPATH", pe.Path)
    }
    return err
}

Prevention

Verify CORE_PEER_MSPCONFIGPATH exists before starting peer/orderer
Ensure the fabric process user owns or can read the MSP tree
In containers, mount the MSP volume read-only at the exact configured path
Regenerate MSP material with cryptogen instead of manually copying files

When it happens

Trigger: Calling GetLocalMspConfig/GetIdemixMspConfig/loadCertificateAt (or InitCrypto which uses them) with a dir/file path where the signcerts, keystore, cacerts or admincerts file path does not exist or lacks read permission.

Common situations: Wrong MSP path passed to peer/orderer config (CORE_PEER_MSPCONFIGPATH), running the process as a user without permissions on the MSP dir, missing signcert file, typo'd path, docker volume not mounted.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/8e8abc75b7c4218b. Report an issue: GitHub.