hyperledger/fabric · error

failed to compare cert public keys

Error message

failed to compare cert public keys

What it means

VerifyAuthRequest wraps a failure of CompareCertPublicKeys comparing the ToId consenter's certificate with this node's own NodeIdentity. The comparison itself errored (e.g. unparsable public keys) rather than simply mismatching, so the request cannot be authenticated as targeted at this node.

Source

Thrown at orderer/common/cluster/clusterservice.go:168

	membership := s.MembershipByChannel[authReq.Channel]
	if membership == nil {
		return nil, errors.Errorf("channel %s not found in config", authReq.Channel)
	}

	fromIdentity := membership.MemberMapping[authReq.FromId]
	if fromIdentity == nil {
		return nil, errors.Errorf("node %d is not member of channel %s", authReq.FromId, authReq.Channel)
	}

	toIdentity := membership.MemberMapping[authReq.ToId]
	if toIdentity == nil {
		return nil, errors.Errorf("node %d is not member of channel %s", authReq.ToId, authReq.Channel)
	}

	equal, err := CompareCertPublicKeys(toIdentity, s.NodeIdentity)
	if err != nil {
		return nil, errors.Wrap(err, "failed to compare cert public keys")
	}
	if !equal {
		s.Logger.Debugf("node id mismatch for node %d, toIdentity: %s, s.NodeIdentity: %s", authReq.FromId, string(toIdentity), string(s.NodeIdentity))
		return nil, errors.Errorf("node id mismatch")
	}

	err = VerifySignature(fromIdentity, SHA256Digest(msg), authReq.Signature)
	if err != nil {
		return nil, errors.Wrap(err, "signature mismatch")
	}

	return authReq, nil
}

func (s *ClusterService) handleMessage(stream ClusterStepStream, addr string, exp *certificateExpirationCheck, channel string, sender uint64, streamID uint64) error {
	request, err := stream.Recv()
	if err == io.EOF {
		return err

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check the ToId consenter's certificate and this node's cluster TLS certificate are valid X.509 certs
2. Reconcile the channel config's consenter certificates with the deployed TLS certificates

When it happens

Trigger: Thrown at orderer/common/cluster/clusterservice.go:168 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/f04428ab9923840a. Report an issue: GitHub.