hyperledger/fabric · error

enrollment certificate is not a valid x509 certificate: %v

Error message

enrollment certificate is not a valid x509 certificate: %v

What it means

When the PEM block has type CERTIFICATE, validateEnrollmentCertificate further parses the DER contents with x509.ParseCertificate. If the DER payload is not a valid X.509 certificate, the error includes the underlying parse error. This catches corrupted or mislabeled certificates.

Source

Thrown at cmd/common/signer/signer.go:91

	sId := &msp.SerializedIdentity{
		Mspid:   mspID,
		IdBytes: b,
	}
	return protoutil.MarshalOrPanic(sId), nil
}

func validateEnrollmentCertificate(b []byte) error {
	bl, _ := pem.Decode(b)
	if bl == nil {
		return errors.Errorf("enrollment certificate isn't a valid PEM block")
	}

	if bl.Type != "CERTIFICATE" {
		return errors.Errorf("enrollment certificate should be a certificate, got a %s instead", strings.ToLower(bl.Type))
	}

	if _, err := x509.ParseCertificate(bl.Bytes); err != nil {
		return errors.Errorf("enrollment certificate is not a valid x509 certificate: %v", err)
	}
	return nil
}

func (si *Signer) Sign(msg []byte) ([]byte, error) {
	switch key := si.key.(type) {
	// Fabric only supports ECDSA and ed25519 at the moment.
	case *ecdsa.PrivateKey:
		digest := util.ComputeSHA256(msg)
		return signECDSA(si.key.(*ecdsa.PrivateKey), digest)
	case ed25519.PrivateKey:
		return ed25519.Sign(si.key.(ed25519.PrivateKey), msg), nil
	default:
		return nil, errors.Errorf("found unknown private key type (%T) in msg signing", key)
	}
}

func loadPrivateKey(file string) (crypto.PrivateKey, error) {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Re-obtain the certificate from the CA or the MSP directory and overwrite the corrupted file
2. Validate manually: openssl x509 -in cert.pem -noout -text must succeed
3. Re-copy the PEM avoiding terminal line-wrap corruption; verify base64 decodes cleanly (base64 -d)
4. Check file size vs. the original / re-download

Example fix

// verify before use
$ openssl x509 -in cert.pem -noout -text
// if it fails, re-export:
fabric-ca-client certificate list / re-enroll to get a fresh cert.pem

if _, err := x509.ParseCertificate(pemBlock.Bytes); err != nil {
    return fmt.Errorf("corrupt certificate: %w", err)
}

func validX509(b []byte) bool {
    blk, _ := pem.Decode(b)
    if blk == nil { return false }
    _, err := x509.ParseCertificate(blk.Bytes)
    return err == nil
}

if err := validateEnrollmentCertificate(b); err != nil {
    if strings.Contains(err.Error(), "not a valid x509") {
        return fmt.Errorf("certificate corrupt — re-export: %w", err)
    }
    return err
}

When it happens

Trigger: pem.Decode succeeds with type CERTIFICATE but the base64 body is corrupted, truncated, or contains non-certificate data (e.g. hand-edited PEM, copy/paste damage, wrong encoding).

Common situations: Certificate truncated during transfer (missing trailing lines); manual copy/paste from a terminal that wrapped lines; binary corruption in storage; a fake/test PEM block.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• invalid certificate DER
• enrollment certificate isn't a valid PEM block
• enrollment certificate should be a certificate, got a %s ins
• public keys do not match
• failed to PEM decode identity bytes: %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/20c907c4bed22ff5. Report an issue: GitHub.