hyperledger/fabric · error

failed to create orderer org

Error message

failed to create orderer org

What it means

After building the orderer group itself, NewOrdererGroup creates each orderer organization's config group via NewOrdererOrgGroup. If any organization fails (typically missing/invalid MSP definition or policy problems), the failure is wrapped with 'failed to create orderer org'. The wrapped error names the specific org problem.

Source

Thrown at internal/configtxgen/encoder/encoder.go:241

		addValue(ordererGroup, channelconfig.OrderersValue(consenterProtos), channelconfig.AdminsPolicyKey)
		if consensusMetadata, err = channelconfig.MarshalBFTOptions(conf.SmartBFT); err != nil {
			return nil, errors.Errorf("consenter options read failed with error %s for orderer type %s", err, ConsensusTypeBFT)
		}
		// Force leader rotation to be turned off
		conf.SmartBFT.LeaderRotation = smartbft.Options_ROTATION_OFF
		// Overwrite policy manually by computing it from the consenters
		policies.EncodeBFTBlockVerificationPolicy(consenterProtos, ordererGroup)
	default:
		return nil, errors.Errorf("unknown orderer type: %s", conf.OrdererType)
	}

	addValue(ordererGroup, channelconfig.ConsensusTypeValue(conf.OrdererType, consensusMetadata), channelconfig.AdminsPolicyKey)

	for _, org := range conf.Organizations {
		var err error
		ordererGroup.Groups[org.Name], err = NewOrdererOrgGroup(org, channelCapabilities)
		if err != nil {
			return nil, errors.Wrap(err, "failed to create orderer org")
		}
	}

	ordererGroup.ModPolicy = channelconfig.AdminsPolicyKey
	return ordererGroup, nil
}

func consenterProtosFromConfig(consenterMapping []*genesisconfig.Consenter) ([]*cb.Consenter, error) {
	var consenterProtos []*cb.Consenter
	for _, consenter := range consenterMapping {
		c := &cb.Consenter{
			Id:    consenter.ID,
			Host:  consenter.Host,
			Port:  consenter.Port,
			MspId: consenter.MSPID,
		}
		// Expect the user to set the config value for client/server certs or identity to the
		// path where they are persisted locally, then load these files to memory.

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Read the wrapped cause — it tells which org and which field (often MSPDir) failed
2. Generate the crypto material first (cryptogen generate or your CA tooling) and confirm MSPDir exists
3. Verify each org in Orderer.Organizations is declared under Organizations with ID and MSPDir set
4. Use absolute or correctly relative MSPDir paths from where configtxgen runs

Example fix

# before
- &OrdererOrg
    Name: OrdererOrg
    ID: OrdererMSP
    MSPDir: crypto-config/missing/ordererOrganizations
# after
- &OrdererOrg
    Name: OrdererOrg
    ID: OrdererMSP
    MSPDir: crypto-config/ordererOrganizations/example.com/msp

func validateOrdererOrgs(orgs []*genesisconfig.Organization) error {
    for _, org := range orgs {
        if org.MSPDir == "" { return fmt.Errorf("org %q missing MSPDir", org.Name) }
        if fi, err := os.Stat(org.MSPDir); err != nil || !fi.IsDir() {
            return fmt.Errorf("org %q MSPDir %q not found", org.Name, org.MSPDir)
        }
    }
    return nil
}

func hasValidMSPDir(org *genesisconfig.Organization) bool {
    fi, err := os.Stat(org.MSPDir); return err == nil && fi.IsDir()
}

group, err := encoder.NewOrdererGroup(conf, caps)
if err != nil && strings.Contains(err.Error(), "failed to create orderer org") {
    return fmt.Errorf("check org MSPDir/policies: %w", err)
}

When it happens

Trigger: NewOrdererGroup iterating conf.Organizations where NewOrdererOrgGroup(org, channelCapabilities) errors for some org — e.g. org with no MSPDir, unreadable MSP directory, or invalid org policies.

Common situations: configtx.yaml Orderer.Organizations entries whose MSPDir points to a nonexistent crypto-config path, running configtxgen before generating crypto material with cryptogen/cryptotool, or referencing an org not defined in the Organizations section.

Related errors

• failed marshaling FabricMSPConfig
• failed unmarshalling fabric msp config
• organization %s not found
• orderer org %s attempted to change MSP ID from %s to %s
• application org %s attempted to change MSP ID from %s to %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d73ae5ba194c8cf9. Report an issue: GitHub.