hyperledger/fabric · error

error adding root certificate

Error message

error adding root certificate

What it means

SecureOptions.TLSConfig guard: one of the PEM blobs in ServerRootCAs could not be appended to the x509 cert pool (AppendCertsFromPEM returned false), meaning the bytes are not a parseable PEM certificate. The at-fault input is that ServerRootCAs entry.

Source

Thrown at internal/pkg/comm/config.go:235

	ServerNameOverride string
}

func (so SecureOptions) TLSConfig() (*tls.Config, error) {
	// if TLS is not enabled, return
	if !so.UseTLS {
		return nil, nil
	}

	tlsConfig := &tls.Config{
		MinVersion:            tls.VersionTLS12,
		ServerName:            so.ServerNameOverride,
		VerifyPeerCertificate: so.VerifyCertificate,
	}
	if len(so.ServerRootCAs) > 0 {
		tlsConfig.RootCAs = x509.NewCertPool()
		for _, certBytes := range so.ServerRootCAs {
			if !tlsConfig.RootCAs.AppendCertsFromPEM(certBytes) {
				return nil, errors.New("error adding root certificate")
			}
		}
	}

	if so.RequireClientCert {
		cert, err := so.ClientCertificate()
		if err != nil {
			return nil, errors.WithMessage(err, "failed to load client certificate")
		}
		tlsConfig.Certificates = append(tlsConfig.Certificates, cert)
	}

	if so.TimeShift > 0 {
		tlsConfig.Time = func() time.Time {
			return time.Now().Add((-1) * so.TimeShift)
		}
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Verify each entry in ServerRootCAs is valid PEM-encoded X.509
2. Check for truncated or concatenated-with-junk certificate files
3. Regenerate or re-download the CA certificate

When it happens

Trigger: Thrown at internal/pkg/comm/config.go:235 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/9ef108dd842f28af. Report an issue: GitHub.