What causes "failed marshaling new certificate" in hyperledger/fabric?

Inspect the failing certificate's extensions (openssl x509 -text) for non-standard fields

failed marshaling new certificate

Error message

failed marshaling new certificate

What it means

After re-building the sanitized certificate struct, SanitizeX509Cert re-marshals it to ASN.1 DER (asn1.Marshal). Failure means the reconstructed certificate structure is not encodable, so the sanitized PEM cannot be produced.

Source

Thrown at common/crypto/sanitize.go:82

	// Else it's high-S, so shift it below half the order.
	s.Sub(curveOrderUsedByCryptoGen, s)

	var newCert certificate
	_, err = asn1.Unmarshal(cert.Raw, &newCert)
	if err != nil {
		return nil, errors.Wrapf(err, "failed unmarshaling certificate")
	}

	newSig, err := utils.MarshalECDSASignature(r, s)
	if err != nil {
		return nil, errors.Wrapf(err, "failed marshaling ECDSA signature")
	}
	newCert.SignatureValue = asn1.BitString{Bytes: newSig, BitLength: len(newSig) * 8}

	newCert.Raw = nil
	newRaw, err := asn1.Marshal(newCert)
	if err != nil {
		return nil, errors.Wrapf(err, "failed marshaling new certificate")
	}

	finalPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: newRaw})
	return finalPEM, nil
}

type certificate struct {
	Raw                asn1.RawContent
	TBSCertificate     tbsCertificate
	SignatureAlgorithm pkix.AlgorithmIdentifier
	SignatureValue     asn1.BitString
}

type tbsCertificate struct {
	Raw                asn1.RawContent
	Version            int `asn1:"optional,explicit,default:0,tag:0"`
	SerialNumber       *big.Int
	SignatureAlgorithm pkix.AlgorithmIdentifier

View on GitHub (pinned to 2736b63f8f)

Solutions

Inspect the failing certificate's extensions (openssl x509 -text) for non-standard fields
Upgrade to a version where certificate sanitization uses x509 certificate re-serialization instead of generic asn1.Marshal
Bypass sanitization for this cert by issuing a fresh certificate from the CA

Example fix

// before
newCert.Raw = nil
newRaw, err := asn1.Marshal(newCert)
// after
if _, err := asn1.Marshal(newCert); err != nil {
    return nil, fmt.Errorf("cannot sanitize cert %s: %w", cert.Subject, err)
}

Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := asn1.Marshal(newCert); err != nil {
    return fmt.Errorf("cert not re-encodable, skip sanitization: %w", err)
}

Try / catch

pemBytes, err := crypto.SanitizeX509Cert(certPEM)
if err != nil && strings.Contains(err.Error(), "failed marshaling new certificate") {
    return nil, fmt.Errorf("certificate structure unsupported by sanitizer: %w", err)
}

Prevention

Avoid feeding certificates with exotic extensions to the sanitizer
Upgrade fabric versions where cert sanitization has been hardened
Fall back to using the original cert when sanitization fails and sanitization is only advisory

When it happens

Trigger: asn1.Marshal(newCert) fails after Raw is set to nil — e.g., the newCert struct contains fields the encoding/asn1 package cannot encode (unexpected field types, invalid BIT STRING, malformed extensions).

Common situations: Certificates with unusual/unexpected extension data or critical fields the generic asn1 struct cannot round-trip; very old or exotic CA-issued certs.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/84c2a02a46e3410f. Report an issue: GitHub.