hyperledger/fabric · critical

expected at least one CA certificate

Error message

expected at least one CA certificate

What it means

setupCAs validation guard: the FabricMSPConfig provided no CA certificates at all (both RootCAs and IntermediateCAs empty after unmarshalling), so the MSP has no trust anchors to initialize and cannot be set up.

Solutions

1. Place the organization's root CA certificate(s) in the MSP cacerts/ directory
2. Regenerate the MSP folder (cryptogen generate / fabric-ca-client enroll+getcacerts)
3. Verify the mspConfigPath points to the directory actually containing cacerts
4. Check that the CA certificates are valid PEM files

Example fix

// before
// msp/
//   cacerts/          (empty)
// after
// msp/
//   cacerts/
//     ca-org1.pem     (root CA cert present)
null

if len(conf.RootCerts) == 0 {
    return errors.New("MSP config has no root CA certificates; populate cacerts/ first")
}

When it happens

Trigger: FabricMSPConfig.RootCerts is an empty array — e.g. the cacerts directory referenced by the MSP config is empty, or the MSP config was generated/loaded without any CA certificates.

Common situations: MSP directory with empty cacerts/ folder; hand-edited config that dropped root certs; misconfigured path so the loader found no PEM files; partial copy of the MSP folder.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• administrators must be declared when no admin ou…
• CA Certificate did not have the CA attribute
• Failed adding OU. Certificate
• Failed computing Certifiers Identifier for
• Failed computing validation chain for

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f2ac2ecb0f0c4261. Report an issue: GitHub.

Appendix: source

Thrown at msp/mspimplsetup.go:110

	if msp.cryptoConfig.SignatureHashFamily == "" {
		msp.cryptoConfig.SignatureHashFamily = bccsp.SHA2
		mspLogger.Debugf("CryptoConfig.SignatureHashFamily was nil. Move to defaults.")
	}
	if msp.cryptoConfig.IdentityIdentifierHashFunction == "" {
		msp.cryptoConfig.IdentityIdentifierHashFunction = bccsp.SHA256
		mspLogger.Debugf("CryptoConfig.IdentityIdentifierHashFunction was nil. Move to defaults.")
	}

	msp.supportedPublicKeyAlgorithms = make(map[x509.PublicKeyAlgorithm]bool)
	msp.supportedPublicKeyAlgorithms[x509.ECDSA] = true

	return nil
}

func (msp *bccspmsp) setupCAs(conf *m.FabricMSPConfig) error {
	// make and fill the set of CA certs - we expect them to be there
	if len(conf.RootCerts) == 0 {
		return errors.New("expected at least one CA certificate")
	}

	// pre-create the verify options with roots and intermediates.
	// This is needed to make certificate sanitation working.
	// Recall that sanitization is applied also to root CA and intermediate
	// CA certificates. After their sanitization is done, the opts
	// will be recreated using the sanitized certs.
	msp.opts = &x509.VerifyOptions{Roots: x509.NewCertPool(), Intermediates: x509.NewCertPool()}
	for _, v := range conf.RootCerts {
		cert, err := msp.getCertFromPem(v)
		if err != nil {
			return err
		}
		msp.opts.Roots.AddCert(cert)
	}
	for _, v := range conf.IntermediateCerts {
		cert, err := msp.getCertFromPem(v)
		if err != nil {

View on GitHub (pinned to 2736b63f8f)