hyperledger/fabric · warning

deliver client identity expired %v before

Error message

deliver client identity expired %v before

What it means

SessionAccessControl.Evaluate refuses deliver requests once the session end time has passed. The decision cache is invalidated at identity expiry, so requests after sessionEndTime are rejected with this error showing how long ago it expired.

Source

Thrown at common/deliver/acl.go:60

// SessionAccessControl holds access control related data for a common Envelope
// that is used to determine if a request is allowed for the identity
// associated with the request envelope.
type SessionAccessControl struct {
	sequencer          ConfigSequencer
	policyChecker      PolicyChecker
	channelID          string
	envelope           *common.Envelope
	lastConfigSequence uint64
	sessionEndTime     time.Time
	usedAtLeastOnce    bool
}

// Evaluate uses the PolicyChecker to determine if a request should be allowed.
// The decision is cached until the identity expires or the chain configuration
// changes.
func (ac *SessionAccessControl) Evaluate() error {
	if !ac.sessionEndTime.IsZero() && time.Now().After(ac.sessionEndTime) {
		return errors.Errorf("deliver client identity expired %v before", time.Since(ac.sessionEndTime))
	}

	policyCheckNeeded := !ac.usedAtLeastOnce

	if currentConfigSequence := ac.sequencer.Sequence(); currentConfigSequence > ac.lastConfigSequence {
		ac.lastConfigSequence = currentConfigSequence
		policyCheckNeeded = true
	}

	if !policyCheckNeeded {
		return nil
	}

	ac.usedAtLeastOnce = true
	return ac.policyChecker.CheckPolicy(ac.envelope, ac.channelID)
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Renew the client certificate/identity and reconnect
2. Adjust the session end time/TTL configuration if it is too short for the workload
3. Synchronize clocks (NTP) between client and orderer/peer to avoid premature expiry

if time.Now().After(sessionEndTime) {
    return errors.New("deliver session expired, renew identity first")
}

err := ac.Evaluate()
if err != nil && strings.Contains(err.Error(), "deliver client identity expired") {
    return renewIdentityAndReconnect() // refresh cert, reopen stream
}

When it happens

Trigger: A deliver (block/filtered-block) request evaluated after time.Now() exceeds ac.sessionEndTime — the client identity's session window has closed.

Common situations: Long-running deliver streams outliving the client cert/session TTL; clock skew between peer and identity-issuing system; stale clients reconnecting after cert renewal.

Related errors

• message is nil
• context finished before block retrieved
• envelope has no header
• channel header in envelope must contain timestamp
• envelope timestamp %s is more than %s apart from current ser

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/ba186383824407da. Report an issue: GitHub.