Failed deserializing proposal creator during channelless che

Error message

Failed deserializing proposal creator during channelless check policy with policy [%s]: [%s]

What it means

The proposal structure was valid, but the local MSP could not deserialize the creator identity found in the SignatureHeader. DeserializeIdentity fails when shdr.Creator is not a well-formed serialized identity in the local MSP's expected format (mspb.SerializedIdentity), meaning the peer cannot even identify who signed the proposal before evaluating the policy.

Source

Thrown at core/policy/policy.go:135

	if err != nil {
		return fmt.Errorf("Failing extracting proposal during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	header, err := protoutil.UnmarshalHeader(proposal.Header)
	if err != nil {
		return fmt.Errorf("Failing extracting header during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	shdr, err := protoutil.UnmarshalSignatureHeader(header.SignatureHeader)
	if err != nil {
		return fmt.Errorf("Invalid Proposal's SignatureHeader during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	// Deserialize proposal's creator with the local MSP
	id, err := p.localMSP.DeserializeIdentity(shdr.Creator)
	if err != nil {
		logger.Warnw("Failed deserializing proposal creator during channelless check policy", "error", err, "policyName", policyName, "identity", protoutil.LogMessageForSerializedIdentity(shdr.Creator))
		return fmt.Errorf("Failed deserializing proposal creator during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	// Load MSPPrincipal for policy
	principal, err := p.principalGetter.Get(policyName)
	if err != nil {
		return fmt.Errorf("Failed getting local MSP principal during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	// Verify that proposal's creator satisfies the principal
	err = id.SatisfiesPrincipal(principal)
	if err != nil {
		logger.Warnw("Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy", "error", err, "policyName", policyName, "requiredPrincipal", principal, "signingIdentity", protoutil.LogMessageForSerializedIdentity(shdr.Creator))
		return fmt.Errorf("Failed verifying that proposal's creator satisfies local MSP principal during channelless check policy with policy [%s]: [%s]", policyName, err)
	}

	// Verify the signature
	return id.Verify(signedProp.ProposalBytes, signedProp.Signature)
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Set the SignatureHeader Creator to the SDK-provided serialized identity (e.g. msp manager SerializationOfIdentity output), never a raw PEM.
Confirm the peer's local MSP (core.yaml / peer msp config) includes the CA chain that issued the signer's certificate.
Verify the signer's cert belongs to an org actually registered in the network config and hasn't expired or been revoked.
Check that the client targets the correct peer/org — identities from one network won't deserialize in another.

Example fix

// before: raw PEM as creator
shdr := &common.SignatureHeader{Creator: pemBytes}

// after: proper serialized identity
serializedID, err := mspMgr.Serialize(signingIdentity)
if err != nil { return err }
shdr := &common.SignatureHeader{Creator: serializedID, Nonce: nonce}

Defensive patterns

Strategy: validation

Validate before calling

shdr, err := protoutil.UnmarshalSignatureHeader(hdr.SignatureHeader)
if err != nil { return err }
if len(shdr.Creator) == 0 {
    return errors.New("SignatureHeader.Creator is empty")
}
sid := &mspb.SerializedIdentity{}
if err := proto.Unmarshal(shdr.Creator, sid); err != nil {
    return fmt.Errorf("Creator is not a marshaled SerializedIdentity: %w", err)
}
if sid.Mspid == "" || len(sid.IdBytes) == 0 {
    return errors.New("SerializedIdentity missingMspid or cert")
}

Type guard

func isSerializedIdentity(creator []byte) bool {
    sid := &mspb.SerializedIdentity{}
    if err := proto.Unmarshal(creator, sid); err != nil {
        return false
    }
    return sid.Mspid != "" && len(sid.IdBytes) > 0
}

Try / catch

err := policyMgr.CheckPolicy(policyName, signedProp)
if err != nil && strings.Contains(err.Error(), "Failed deserializing proposal creator") {
    // verify the signer belongs to an MSP trusted by the peer, re-enroll if needed
}

Prevention

Only put mspb.SerializedIdentity bytes (not raw PEM) in SignatureHeader.Creator
Ensure the signer's org MSP is deployed on the peer (admin/members cacerts)
Keep certificates valid and re-enroll before expiry
Target peers in the same org/network as the signing identity

When it happens

Trigger: Creator bytes are a PEM certificate or raw cert DER instead of a marshaled mspb.SerializedIdentity; the identity was issued by an MSP not trusted/configured on the peer; identity from a different org's MSP; or creator bytes nil/empty.

Common situations: Client signed with a cert from an org whose MSP config is missing on the peer; MSP ID renamed or re-enrolled certificates after a CA change; custom SDK writing wrong creator format; mixing identities across Fabric versions/networks.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c0367faeaf39ee16. Report an issue: GitHub.