hyperledger/fabric · error

failed to unmarshal AKI

Error message

failed to unmarshal AKI

What it means

While extracting the Authority Key Identifier (AKI) from a CRL's TBSCertList extensions (OID 2.5.29.35), the ASN.1 unmarshal of the extension value failed. Fabric wraps the parse error as 'failed to unmarshal AKI' because the CRL is needed to check whether the certificate in the chain was revoked.

Source

Thrown at msp/mspimplvalidate.go:342

type authorityKeyIdentifier struct {
	KeyIdentifier             []byte  `asn1:"optional,tag:0"`
	AuthorityCertIssuer       []byte  `asn1:"optional,tag:1"`
	AuthorityCertSerialNumber big.Int `asn1:"optional,tag:2"`
}

// getAuthorityKeyIdentifierFromCrl returns the Authority Key Identifier
// for the supplied CRL. The authority key identifier can be used to identify
// the public key corresponding to the private key which was used to sign the CRL.
func getAuthorityKeyIdentifierFromCrl(crl *pkix.CertificateList) ([]byte, error) {
	aki := authorityKeyIdentifier{}

	for _, ext := range crl.TBSCertList.Extensions {
		// Authority Key Identifier is identified by the following ASN.1 tag
		// authorityKeyIdentifier (2 5 29 35) (see https://tools.ietf.org/html/rfc3280.html)
		if reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 35}) {
			_, err := asn1.Unmarshal(ext.Value, &aki)
			if err != nil {
				return nil, errors.Wrap(err, "failed to unmarshal AKI")
			}

			return aki.KeyIdentifier, nil
		}
	}

	return nil, errors.New("authorityKeyIdentifier not found in certificate")
}

// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate
// Subject Key Identifier is an identifier of the public key of this certificate
func getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {
	var SKI []byte

	for _, ext := range cert.Extensions {
		// Subject Key Identifier is identified by the following ASN.1 tag
		// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)
		if reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate the CRL with a standards-compliant tool (openssl ca -gencrl or fabric-ca)
2. Verify the CRL: openssl crl -in crl.pem -noout -text and confirm the AKI extension parses
3. Remove the malformed CRL file from the MSP's crls directory if revocation checking against it is not required

Example fix

// before: manually concatenated/corrupt CRL
cat partial.crl.pem > msp/crls/crl.pem
// after: regenerate properly
openssl ca -gencrl -keyfile ca.key -cert ca.pem -out msp/crls/crl.pem

import ("encoding/pem"; "crypto/x509/pkix")
func checkCRLParses(crlPEM []byte) error {
    blk, _ := pem.Decode(crlPEM)
    if blk == nil { return fmt.Errorf("not PEM") }
    crl, err := x509.ParseRevocationList(blk.Bytes)
    if err != nil { return err }
    if crl.AuthorityKeyId == nil { return fmt.Errorf("missing AKI") }
    return nil
}
// Run over each file in msp/crls before MSP setup.

When it happens

Trigger: validateCertAgainstChain calls getAuthorityKeyIdentifierFromCrl on a CRL whose authorityKeyIdentifier extension value is malformed or not DER-encoded per PKIX.

Common situations: Hand-crafted or truncated CRL PEM in the intermediates/crl folder of the MSP; CRL produced by a non-compliant tool; binary corruption of the CRL file.

Related errors

• authorityKeyIdentifier not found in certificate
• failed to unmarshal Subject Key Identifier
• error converting policy with reference '%s' on channel '%s'
• collection-name: %s -- collection member '%s' is not part of
• collection-name: %s -- contains an identity that is not part

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/2d78fcddea873e81. Report an issue: GitHub.