hyperledger/fabric · error

failed classifying identity

Error message

failed classifying identity

What it means

Put calls is.mcs.Expiration(identity) to determine when the certificate expires; this error is errors.Wrap around whatever failure the MessageCryptoService reported while classifying (parsing/extracting expiry of) the identity. It indicates the certificate could not be parsed or evaluated by the crypto layer, not a nil-input problem.

Source

Thrown at gossip/identity/identity.go:113

				return false
			})
		}
	}
}

// put associates an identity to its given pkiID, and returns an error
// in case the given pkiID doesn't match the identity
func (is *identityMapperImpl) Put(pkiID common.PKIidType, identity api.PeerIdentityType) error {
	if pkiID == nil {
		return errors.New("PKIID is nil")
	}
	if identity == nil {
		return errors.New("identity is nil")
	}

	expirationDate, err := is.mcs.Expiration(identity)
	if err != nil {
		return errors.Wrap(err, "failed classifying identity")
	}

	if err := is.mcs.ValidateIdentity(identity); err != nil {
		return err
	}

	id := is.mcs.GetPKIidOfCert(identity)
	if !bytes.Equal(pkiID, id) {
		return errors.New("identity doesn't match the computed pkiID")
	}

	is.Lock()
	defer is.Unlock()
	// Check if identity already exists.
	// If so, no need to overwrite it.
	if _, exists := is.pkiID2Cert[string(pkiID)]; exists {
		return nil
	}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Inspect the wrapped cause with errors.Cause/%+v to see the underlying MCS failure and fix the certificate (renew, re-enroll, or replace)
2. Verify the peer's MSP directory contains valid, complete crypto material
3. Ensure identities come from the same network/MSP the local peer trusts

Example fix

// before
err := mapper.Put(pkiID, identity) // wrapped classification error, cause hidden

// after
err := mapper.Put(pkiID, identity)
if err != nil {
    logger.Warningf("identity rejected: %v", err) // logs wrapped MCS cause
    return
}

// pre-check expiration via the same MCS before Put
exp, err := mcs.Expiration(identity)
if err != nil || exp.Before(time.Now()) {
    return fmt.Errorf("identity not usable: %v", err)
}
err = mapper.Put(pkiID, identity)

if err := mapper.Put(pkiID, identity); err != nil {
    logger.Warningf("identity rejected by mapper: %+v", err) // reveals wrapped MCS cause
    return
}

When it happens

Trigger: Calling Put with a well-formed non-nil identity whose certificate the MCS cannot classify — corrupt/expired X.509 certs, certificates from a foreign MSP, or crypto material not initialized on the peer.

Common situations: Peer's MSP not configured correctly (missing/corrupt certs in MSP folder); messages signed with identities from an unrelated network; certificate format changes after cert rotation.

Related errors

• Could not sign the ccpackage, err %s
• identity doesn't match the computed pkiID
• Could not acquire policy manager for channel %s
• Invalid Block on channel [%s]. Block is nil.
• Invalid Peer Identity. It must be different from nil.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/3faf73a48ffb256c. Report an issue: GitHub.