hyperledger/fabric · error

failed to unmarshal Subject Key Identifier

Error message

failed to unmarshal Subject Key Identifier

What it means

Extracting the Subject Key Identifier (SKI, OID 2.5.29.14) from a certificate failed at ASN.1 unmarshal time. getSubjectKeyIdentifierFromCert is used to compute/compare key identifiers when building the CA chain (finalizeSetupCAs, setupTLSCAs) and validating certs against the chain, so a malformed SKI extension aborts the operation with this wrapped error.

Source

Thrown at msp/mspimplvalidate.go:363

			return aki.KeyIdentifier, nil
		}
	}

	return nil, errors.New("authorityKeyIdentifier not found in certificate")
}

// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate
// Subject Key Identifier is an identifier of the public key of this certificate
func getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {
	var SKI []byte

	for _, ext := range cert.Extensions {
		// Subject Key Identifier is identified by the following ASN.1 tag
		// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)
		if reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {
			_, err := asn1.Unmarshal(ext.Value, &SKI)
			if err != nil {
				return nil, errors.Wrap(err, "failed to unmarshal Subject Key Identifier")
			}

			return SKI, nil
		}
	}

	return nil, errors.New("subjectKeyIdentifier not found in certificate")
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Replace the malformed certificate with one generated by a standards-compliant tool (openssl, fabric-ca, cryptogen)
2. Validate each cert: openssl x509 -in cert.pem -noout -text and confirm 'X509v3 Subject Key Identifier' parses
3. Re-copy the MSP directory from the trusted source (e.g. crypto-config or the org's admin) to rule out file corruption

Example fix

# before: inspect to find the bad cert
for f in msp/cacerts/*.pem; do openssl x509 -in $f -noout -text || echo "BAD: $f"; done
# after: replace BAD cert with a valid one
openssl x509 -in valid_ca.pem -out msp/cacerts/ca.pem

import ("encoding/pem"; "crypto/x509")
func certSKIReadable(certPEM []byte) error {
    blk, _ := pem.Decode(certPEM)
    if blk == nil { return fmt.Errorf("not PEM") }
    cert, err := x509.ParseCertificate(blk.Bytes)
    if err != nil { return err }
    if len(cert.SubjectKeyId) == 0 { return fmt.Errorf("missing SKI") }
    return nil
}
// Check cacerts, tlscacerts, intermediatescerts, signcerts before MSP setup.

When it happens

Trigger: asn1.Unmarshal(ext.Value, &SKI) fails for the subjectKeyIdentifier extension during setupCAs/TLS CA setup or validateCertAgainstChain on a certificate with a corrupt or non-DER SKI extension value.

Common situations: Certificates generated by non-compliant tooling or edited by hand; truncated PEM files in msp/signcerts, cacerts, tlscacerts, or intermediatescerts; conversion errors (e.g. re-encoding certs with broken base64/DER).

Related errors

• parseCertificate failed
• An X509 certificate with Basic Constraint: Certificate Autho
• the supplied identity has no verify options
• this MSP only supports a single validation chain, got %d
• expected a chain of length at least 2, got %d

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/910442a398540230. Report an issue: GitHub.