Failed adding OU. Certificate [%v] not in root or intermedia

Error message

Failed adding OU. Certificate [%v] not in root or intermediate certs.

What it means

getCertifiersIdentifier requires that the certificate being classified appear among the MSP's rootCerts or intermediateCerts. If the certificate is found in neither list after comparison, the configuration is rejected because OU classification cannot be traced to a trusted CA.

Source

Thrown at msp/mspimplsetup.go:58

	for _, v := range msp.rootCerts {
		if v.(*identity).cert.Equal(cert) {
			found = true
			root = true
			break
		}
	}
	if !found {
		// Search among root intermediate certificates
		for _, v := range msp.intermediateCerts {
			if v.(*identity).cert.Equal(cert) {
				found = true
				break
			}
		}
	}
	if !found {
		// Certificate not valid, reject configuration
		return nil, fmt.Errorf("Failed adding OU. Certificate [%v] not in root or intermediate certs.", cert)
	}

	// 3. get the certification path for it
	var certifiersIdentifier []byte
	var chain []*x509.Certificate
	if root {
		chain = []*x509.Certificate{cert}
	} else {
		chain, err = msp.getValidationChain(cert, true)
		if err != nil {
			return nil, fmt.Errorf("Failed computing validation chain for [%v]. [%s]", cert, err)
		}
	}

	// 4. compute the hash of the certification path
	certifiersIdentifier, err = msp.getCertificationChainIdentifierFromChain(chain)
	if err != nil {
		return nil, fmt.Errorf("Failed computing Certifiers Identifier for [%v]. [%s]", certRaw, err)

View on GitHub (pinned to 2736b63f8f)

Solutions

Ensure each FabricNodeOus OU identifier certificate matches a cert listed in the MSP's rootCerts or intermediateCerts
Regenerate the NodeOUs config (configtxgen / fabric-ca) so identifiers align with the org's CA certificates
Update the OU identifier certificates after CA rotation
Verify the MSP directory contents (cacerts/intermediatecerts) match the channel config

Example fix

// before: FabricNodeOus.ClientOuIdentifier.Certificate from foreign CA
// after: certificate equal to one in rootCerts/intermediateCerts of this MSP
null

Defensive patterns

Strategy: validation

Validate before calling

// before setup, ensure every NodeOU identifier cert is in root/intermediate set
for _, ou := range conf.FabricNodeOus.OUIDentifiers() {
    if !containsCert(rootCerts, ou.Certificate) && !containsCert(intermediateCerts, ou.Certificate) {
        return fmt.Errorf("OU identifier cert not in CA lists")
    }
}

Type guard

func certInList(certRaw []byte, list [][]byte) bool {
    for _, c := range list {
        if bytes.Equal(certRaw, c) { return true }
    }
    return false
}

Prevention

Always regenerate NodeOUs identifiers from the same CA that issued root/intermediate certs
Update OU identifier certificates whenever CAs are rotated
Diff FabricNodeOus certificates against cacerts/intermediatecerts as part of deployment checks

When it happens

Trigger: setupNodeOUs or setupOUs is given an OU identifier certificate (certifiers identifier computation) whose certificate is not registered in the MSP's root or intermediate CA lists — e.g. FabricNodeOus.*OuIdentifier.Certificate refers to a CA not in rootCerts/intermediateCerts.

Common situations: FabricNodeOus config entries (client/peer/admin/orderer OU) referencing a certificate from a different CA; copying NodeOUs config from one org to another without updating certs; root cert rotated but OU identifier cert left stale.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/49647d5e8ff5c498. Report an issue: GitHub.