What causes "enrollment certificate isn't a valid PEM block" in hyperledger/fabric?

Convert the certificate to PEM format: openssl x509 -inform DER -in cert.der -out cert.pem

enrollment certificate isn't a valid PEM block

Error message

enrollment certificate isn't a valid PEM block

What it means

validateEnrollmentCertificate parses the enrollment certificate bytes with pem.Decode; if the bytes do not form any PEM block (nil result), it throws this error. The Signer requires the identity file to be a PEM-encoded certificate, so non-PEM input is rejected early in serializeIdentity.

Source

Thrown at cmd/common/signer/signer.go:83

func serializeIdentity(clientCert string, mspID string) ([]byte, error) {
	b, err := os.ReadFile(clientCert)
	if err != nil {
		return nil, errors.WithStack(err)
	}
	if err := validateEnrollmentCertificate(b); err != nil {
		return nil, err
	}
	sId := &msp.SerializedIdentity{
		Mspid:   mspID,
		IdBytes: b,
	}
	return protoutil.MarshalOrPanic(sId), nil
}

func validateEnrollmentCertificate(b []byte) error {
	bl, _ := pem.Decode(b)
	if bl == nil {
		return errors.Errorf("enrollment certificate isn't a valid PEM block")
	}

	if bl.Type != "CERTIFICATE" {
		return errors.Errorf("enrollment certificate should be a certificate, got a %s instead", strings.ToLower(bl.Type))
	}

	if _, err := x509.ParseCertificate(bl.Bytes); err != nil {
		return errors.Errorf("enrollment certificate is not a valid x509 certificate: %v", err)
	}
	return nil
}

func (si *Signer) Sign(msg []byte) ([]byte, error) {
	switch key := si.key.(type) {
	// Fabric only supports ECDSA and ed25519 at the moment.
	case *ecdsa.PrivateKey:
		digest := util.ComputeSHA256(msg)
		return signECDSA(si.key.(*ecdsa.PrivateKey), digest)

View on GitHub (pinned to 2736b63f8f)

Solutions

Convert the certificate to PEM format: openssl x509 -inform DER -in cert.der -out cert.pem
Verify the file starts with '-----BEGIN CERTIFICATE-----' (cat the file, check for stray whitespace/BOM)
Re-export the enrollment certificate from the Fabric CA as PEM
Confirm the identity path in config points to the certificate, not the key or another file

Example fix

// before: identity file is raw DER bytes
// after
openssl x509 -inform DER -in cert.der -out cert.pem
# config: signer.identity: /path/to/cert.pem

Defensive patterns

Strategy: validation

Validate before calling

b, _ := os.ReadFile(identityPath)
if block, _ := pem.Decode(b); block == nil || block.Type != "CERTIFICATE" {
    return fmt.Errorf("%s is not a PEM certificate", identityPath)
}

Type guard

func isPEMCertificate(b []byte) bool {
    blk, _ := pem.Decode(b)
    return blk != nil && blk.Type == "CERTIFICATE"
}

Try / catch

if _, err := signer.NewSigner(keyPath, idPath); err != nil {
    if strings.Contains(err.Error(), "valid PEM block") {
        return fmt.Errorf("identity %s is not PEM; convert with openssl x509 -inform DER", idPath)
    }
    return err
}

Prevention

Always use PEM (openssl default -outform PEM) for identities
Sanity-check cert files with openssl x509 -noout -text before deployment
Don't confuse DER exports with PEM in material pipelines

When it happens

Trigger: Calling NewSigner (leading to serializeIdentity) with an identity file whose contents are raw DER bytes, base64 without PEM armor, an HTML/text error page, an empty file, or a file with a BOM/whitespace-only content.

Common situations: Certificate exported in DER format instead of PEM; accidentally downloading the cert URL instead of the cert; file truncated or empty; concatenating the wrong file as identity.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/9c610d80e5a7fab6. Report an issue: GitHub.