hyperledger/fabric · error

error loading client root CAs (%s)

Error message

error loading client root CAs (%s)

What it means

Returned by peer GetServerConfig when loading the client root CA files (peer.tls.clientRootCAs.files) fails while client authentication is required. One of the listed CA files is missing or unreadable, blocking mutual-TLS server setup.

Source

Thrown at core/peer/config.go:416

		if err != nil {
			return serverConfig, fmt.Errorf("error loading TLS key (%s)", err)
		}
		serverCert, err := os.ReadFile(config.GetPath("peer.tls.cert.file"))
		if err != nil {
			return serverConfig, fmt.Errorf("error loading TLS certificate (%s)", err)
		}
		serverConfig.SecOpts.Certificate = serverCert
		serverConfig.SecOpts.Key = serverKey
		serverConfig.SecOpts.RequireClientCert = viper.GetBool("peer.tls.clientAuthRequired")
		if serverConfig.SecOpts.RequireClientCert {
			var clientRoots [][]byte
			for _, file := range viper.GetStringSlice("peer.tls.clientRootCAs.files") {
				clientRoot, err := os.ReadFile(
					config.TranslatePath(filepath.Dir(viper.ConfigFileUsed()), file),
				)
				if err != nil {
					return serverConfig,
						fmt.Errorf("error loading client root CAs (%s)", err)
				}
				clientRoots = append(clientRoots, clientRoot)
			}
			serverConfig.SecOpts.ClientRootCAs = clientRoots
		}
		// check for root cert
		if config.GetPath("peer.tls.rootcert.file") != "" {
			rootCert, err := os.ReadFile(config.GetPath("peer.tls.rootcert.file"))
			if err != nil {
				return serverConfig, fmt.Errorf("error loading TLS root certificate (%s)", err)
			}
			serverConfig.SecOpts.ServerRootCAs = [][]byte{rootCert}
		}
	}
	// get the default keepalive options
	serverConfig.KaOpts = comm.DefaultKeepaliveOptions
	// check to see if interval is set for the env
	if viper.IsSet("peer.keepalive.interval") {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check every file in peer.tls.clientRootCAs.files exists and is a valid PEM CA cert
2. Fix paths/permissions in core.yaml

When it happens

Trigger: Thrown at core/peer/config.go:416 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/9c7e7241349d70de. Report an issue: GitHub.