What causes "Error creating signed proposal %s" in hyperledger/fabric?

Ensure CORE_PEER_MSPCONFIGPATH/keystore contains the private key matching signcerts and is readable.

Error creating signed proposal %s

Error message

Error creating signed proposal %s

What it means

After building the join proposal, executeJoin signs it with protoutil.GetSignedProposal(cf.Signer). If signing fails — the signer cannot produce a valid signature over the proposal (e.g. missing or unreadable private key) — this error is returned. It occurs before the proposal is sent to the endorser.

Source

Thrown at internal/peer/channel/join.go:97

func executeJoin(cf *ChannelCmdFactory, spec *pb.ChaincodeSpec) (err error) {
	// Build the ChaincodeInvocationSpec message
	invocation := &pb.ChaincodeInvocationSpec{ChaincodeSpec: spec}

	creator, err := cf.Signer.Serialize()
	if err != nil {
		return fmt.Errorf("Error serializing identity for %s: %s", cf.Signer.GetIdentifier(), err)
	}

	var prop *pb.Proposal
	prop, _, err = protoutil.CreateProposalFromCIS(pcommon.HeaderType_CONFIG, "", invocation, creator)
	if err != nil {
		return fmt.Errorf("Error creating proposal for join %s", err)
	}

	var signedProp *pb.SignedProposal
	signedProp, err = protoutil.GetSignedProposal(prop, cf.Signer)
	if err != nil {
		return fmt.Errorf("Error creating signed proposal %s", err)
	}

	var proposalResp *pb.ProposalResponse
	proposalResp, err = cf.EndorserClient.ProcessProposal(context.Background(), signedProp)
	if err != nil {
		return ProposalFailedErr(err.Error())
	}

	if proposalResp == nil {
		return ProposalFailedErr("nil proposal response")
	}

	if proposalResp.Response.Status != 0 && proposalResp.Response.Status != http.StatusOK {
		return ProposalFailedErr(fmt.Sprintf("bad proposal response %d: %s", proposalResp.Response.Status, proposalResp.Response.Message))
	}
	logger.Info("Successfully submitted proposal to join channel")
	return nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Ensure CORE_PEER_MSPCONFIGPATH/keystore contains the private key matching signcerts and is readable.
Fix file permissions (chmod 600) or re-copy the full admin MSP directory.
Verify BCCSP configuration (software vs PKCS11/HSM) matches how the key was generated.
Regenerate the admin identity if cert and key no longer match.

Example fix

// before
ls msp/keystore   # empty — key missing
// after
cp admin_sk msp/keystore/priv_sk && chmod 600 msp/keystore/priv_sk

Defensive patterns

Strategy: validation

Validate before calling

// bash
KEY=$(ls "$CORE_PEER_MSPCONFIGPATH/keystore" 2>/dev/null | head -n1)
[ -n "$KEY" ] && [ -r "$CORE_PEER_MSPCONFIGPATH/keystore/$KEY" ] \
  || { echo "no readable private key in keystore"; exit 1; }
chmod 600 "$CORE_PEER_MSPCONFIGPATH/keystore/$KEY"

Prevention

Ensure keystore contains the private key matching signcerts before any signing operation.
Set 600 permissions on key files and correct ownership for the CLI user.
Match BCCSP config (SW vs PKCS11) to how keys were provisioned.
Copy complete MSP directories, never cert-only subsets.

When it happens

Trigger: Running `peer channel join` when the local MSP signing identity lacks a usable private key: empty keystore, wrong key file permissions, or an msp config path where the signcert does not match the keystore key.

Common situations: Admin MSP directory copied without the keystore; key file renamed or with 000 permissions; mismatched cert/key after regenerating crypto material; BCCSP/HSM keystore misconfiguration in core.yaml.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f2c57484d5b8b19e. Report an issue: GitHub.