hyperledger/fabric · error

Failed computing validation chain for

Error message

Failed computing validation chain for [%v]. [%s]

What it means

For intermediate-CA-issued certificates, getCertifiersIdentifier builds the validation chain with getValidationChain. If the chain cannot be computed (missing issuer cert, expired CA, verification failure), setup fails with this wrapped error.

Solutions

1. Add the root CA certificate of the intermediate to the MSP cacerts directory
2. Check CA validity windows (notBefore/notAfter) with openssl x509 -dates
3. Re-copy the full MSP directory so intermediatecerts and cacerts are consistent
4. Re-issue the intermediate/leaf chain from the CA

roots := x509.NewCertPool()
for _, r := range rootPEMs { roots.AddCert(r) }
if _, err := leafCert.Verify(x509.VerifyOptions{Roots: roots,
    Intermediates: interPool, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageAny}}); err != nil {
    return fmt.Errorf("chain will not validate: %w", err)
}

When it happens

Trigger: getValidationChain(cert, true) returns an error during setupNodeOUs/setupOUs because the intermediate certificate's issuer (root CA) is not available/valid in the MSP, or chain verification fails.

Common situations: Intermediate CA present in intermediatecerts but its root missing from cacerts; expired or not-yet-valid CA certificates; intermediate signed by a root not in the MSP config; corrupted chain after partial MSP directory copy.

Related errors

• Failed adding OU. Certificate
• Failed getting certificate for
• administrators must be declared when no admin ou…
• CA Certificate did not have the CA attribute
• could not parse RevocationList

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/790d9fc75ff7ebd2. Report an issue: GitHub.

Appendix: source

Thrown at msp/mspimplsetup.go:69

				found = true
				break
			}
		}
	}
	if !found {
		// Certificate not valid, reject configuration
		return nil, fmt.Errorf("Failed adding OU. Certificate [%v] not in root or intermediate certs.", cert)
	}

	// 3. get the certification path for it
	var certifiersIdentifier []byte
	var chain []*x509.Certificate
	if root {
		chain = []*x509.Certificate{cert}
	} else {
		chain, err = msp.getValidationChain(cert, true)
		if err != nil {
			return nil, fmt.Errorf("Failed computing validation chain for [%v]. [%s]", cert, err)
		}
	}

	// 4. compute the hash of the certification path
	certifiersIdentifier, err = msp.getCertificationChainIdentifierFromChain(chain)
	if err != nil {
		return nil, fmt.Errorf("Failed computing Certifiers Identifier for [%v]. [%s]", certRaw, err)
	}

	return certifiersIdentifier, nil
}

func (msp *bccspmsp) setupCrypto(conf *m.FabricMSPConfig) error {
	msp.cryptoConfig = conf.CryptoConfig
	if msp.cryptoConfig == nil {
		// Move to defaults
		msp.cryptoConfig = &m.FabricCryptoConfig{
			SignatureHashFamily:            bccsp.SHA2,

View on GitHub (pinned to 2736b63f8f)