hyperledger/fabric · error

gossipping peer identity expired

Error message

gossipping peer identity expired

What it means

identityMapperImpl.Put rejects an identity whose expiration date has already passed when it is being registered in the mapper's pkiID2Cert map. The gossip identity layer only stores identities that are still valid, since expired identities would immediately be purged by the expiration timer anyway. Callers (e.g. NewIdentityMapper during genesis/startup) must never feed already-expired certificates.

Source

Thrown at gossip/identity/identity.go:136

	}

	id := is.mcs.GetPKIidOfCert(identity)
	if !bytes.Equal(pkiID, id) {
		return errors.New("identity doesn't match the computed pkiID")
	}

	is.Lock()
	defer is.Unlock()
	// Check if identity already exists.
	// If so, no need to overwrite it.
	if _, exists := is.pkiID2Cert[string(pkiID)]; exists {
		return nil
	}

	var expirationTimer *time.Timer
	if !expirationDate.IsZero() {
		if time.Now().After(expirationDate) {
			return errors.New("gossipping peer identity expired")
		}
		// Identity would be wiped out a millisecond after its expiration date
		timeToLive := time.Until(expirationDate.Add(time.Millisecond))
		expirationTimer = time.AfterFunc(timeToLive, func() {
			is.delete(pkiID, identity)
		})
	}

	is.pkiID2Cert[string(id)] = newStoredIdentity(pkiID, identity, expirationTimer, is.sa.OrgByPeerIdentity(identity))
	return nil
}

// get returns the identity of a given pkiID, or error if such an identity
// isn't found
func (is *identityMapperImpl) Get(pkiID common.PKIidType) (api.PeerIdentityType, error) {
	is.RLock()
	defer is.RUnlock()
	storedIdentity, exists := is.pkiID2Cert[string(pkiID)]

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Renew or replace the expired peer identity (MSP certificate) and its expiration date before starting the peer
2. Delete stale persisted identity data so Put is only called with valid identities
3. Verify system clocks (NTP) to rule out skew causing time.Now() to be past a still-valid expiration
4. If this is test code, generate identities with future expiration dates

Example fix

// before
mapper.NewIdentityMapper(...).Put(pkiID, expiredIdentity)
// after
if !identityExpiration.IsZero() && time.Now().After(identityExpiration) {
    // renew cert / skip entry
}
mapper.NewIdentityMapper(...).Put(pkiID, validIdentity)

func canPut(identity api.PeerIdentityType, expiration time.Time) bool {
    return expiration.IsZero() || !time.Now().After(expiration)
}
if canPut(id, expirationDate) {
    mapper.Put(pkiID, id)
}

func identityNotExpired(expiration time.Time) bool {
    return expiration.IsZero() || time.Now().Before(expiration)
}

When it happens

Trigger: Calling Put (directly or via NewIdentityMapper) with an api.PeerIdentityType whose configured expirationDate is non-zero and earlier than time.Now() — e.g. loading a snapshot/persisted identity store containing expired entries or passing an already-expired certificate at mapper creation.

Common situations: Peer restarted with a stale persistence directory after its TLS/identity certificate expired; clock skew between machines; restoring identity store from backup; tests fabricating identities with past expiration dates.

Related errors

• PKIID is nil
• identity is nil
• identity doesn't match the computed pkiID
• PKIID wasn't found
• broadcast client identity expired

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/5eb8e93fbf2eec3f. Report an issue: GitHub.