hyperledger/fabric · error

identity is nil

Error message

identity is nil

What it means

Returned by identityMapperImpl.Put when the identity argument is nil (the pkiID was already checked). The mapper refuses to register a nil peer identity, since neither expiration checks nor pkiID binding could proceed.

Source

Thrown at gossip/identity/identity.go:108

		select {
		case <-is.stopChan:
			return
		case <-time.After(usageTh / 10):
			is.SuspectPeers(func(_ api.PeerIdentityType) bool {
				return false
			})
		}
	}
}

// put associates an identity to its given pkiID, and returns an error
// in case the given pkiID doesn't match the identity
func (is *identityMapperImpl) Put(pkiID common.PKIidType, identity api.PeerIdentityType) error {
	if pkiID == nil {
		return errors.New("PKIID is nil")
	}
	if identity == nil {
		return errors.New("identity is nil")
	}

	expirationDate, err := is.mcs.Expiration(identity)
	if err != nil {
		return errors.Wrap(err, "failed classifying identity")
	}

	if err := is.mcs.ValidateIdentity(identity); err != nil {
		return err
	}

	id := is.mcs.GetPKIidOfCert(identity)
	if !bytes.Equal(pkiID, id) {
		return errors.New("identity doesn't match the computed pkiID")
	}

	is.Lock()
	defer is.Unlock()

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Check identity != nil (or len(identity) > 0) before calling Put
2. Fix the upstream identity resolution so real peer identities (certificates) are passed in
3. Drop/ignore messages that arrive with a nil identity rather than registering them

Example fix

// before
err := mapper.Put(pkiID, identity) // identity may be nil

// after
if identity == nil {
    return errors.New("cannot put nil identity")
}
err := mapper.Put(pkiID, identity)

if identity == nil {
    return errors.New("refusing to put nil identity")
}
err := mapper.Put(pkiID, identity)

func hasIdentity(id api.PeerIdentityType) bool { return id != nil && len(id) > 0 }

if err := mapper.Put(pkiID, identity); err != nil && err.Error() == "identity is nil" {
    logger.Warning("nil identity ignored")
    return
}

When it happens

Trigger: Calling Put with identity = nil — e.g. the caller received a nil identity from a lookup (GetIdentityInfoByPkiID etc.) and passed it through, or constructed api.PeerIdentityType(nil).

Common situations: Membership handlers forwarding message identities that failed to deserialize; tests passing nil identities; a peer message carrying a certificate that was never resolved to a concrete identity.

Related errors

• PKIID is nil
• identity doesn't match the computed pkiID
• failed unmarshaling identity %s
• Could not serialize the signing identity: %s
• block from orderer could not be re-marshaled: proto: Marshal

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c358587dbe8f861a. Report an issue: GitHub.