hyperledger/fabric · error

invalid certificate DER

Error message

invalid certificate DER

What it means

In Comm.createRemoteContext, the stub's ServerTLSCert bytes failed x509.ParseCertificate, meaning the stored certificate is not valid DER-encoded X.509 data. The error wraps the underlying parse error and logs the PEM-encoded bytes to aid diagnosis. This indicates corrupted or wrong-format TLS certificate data in the membership stub.

Source

Thrown at orderer/common/cluster/comm.go:278

	// Check if the stub needs activation.
	if stub.Active() {
		return
	}

	// Activate the stub
	stub.Activate(c.createRemoteContext(stub, channel))
}

// createRemoteContext returns a function that creates a RemoteContext.
// It is used as a parameter to Stub.Activate() in order to activate
// a stub atomically.
func (c *Comm) createRemoteContext(stub *Stub, channel string) func() (*RemoteContext, error) {
	return func() (*RemoteContext, error) {
		cert, err := x509.ParseCertificate(stub.ServerTLSCert)
		if err != nil {
			pemString := string(pem.EncodeToMemory(&pem.Block{Bytes: stub.ServerTLSCert}))
			c.Logger.Errorf("Invalid DER for channel %s, endpoint %s, ID %d: %v", channel, stub.Endpoint, stub.ID, pemString)
			return nil, errors.Wrap(err, "invalid certificate DER")
		}

		c.Logger.Debug("Connecting to", stub.RemoteNode, "for channel", channel)

		conn, err := c.Connections.Connection(stub.Endpoint, stub.ServerTLSCert)
		if err != nil {
			c.Logger.Warningf("Unable to obtain connection to %d(%s) (channel %s): %v", stub.ID, stub.Endpoint, channel, err)
			return nil, err
		}

		probeConnection := func(conn *grpc.ClientConn) error {
			connState := conn.GetState()
			if connState == connectivity.Connecting {
				return errors.Errorf("connection to %d(%s) is in state %s", stub.ID, stub.Endpoint, connState)
			}
			return nil
		}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Inspect the logged PEM output in the orderer log to see what bytes are actually stored; verify they decode to a valid certificate.
2. Re-check the channel config (orderer endpoints / consenter TLS certs) and ensure the correct DER certificate bytes are supplied.
3. Regenerate or re-export the node's TLS certificate and update the channel config via a config update transaction.
4. If using cryptogen/fabric-ca, re-issue certificates and redeploy, then restart the ordering service.

Example fix

// before
rawPEM, _ := os.ReadFile("server.crt") // PEM text stored as-is
stub.ServerTLSCert = rawPEM
// after
block, _ := pem.Decode(rawPEM) // extract DER bytes
if block == nil { return errors.New("no PEM block") }
stub.ServerTLSCert = block.Bytes

// Go: pre-validate the stub's TLS cert parses before triggering RemoteContext creation
if _, err := x509.ParseCertificate(stub.ServerTLSCert); err != nil {
    return fmt.Errorf("stub %d has invalid TLS cert DER: %w", stub.ID, err)
}

func validCertDER(der []byte) bool {
    _, err := x509.ParseCertificate(der)
    return err == nil
}

remoteCtx, err := comm.Remote(channel, id)
if err != nil {
    var parseErr error
    if strings.Contains(err.Error(), "invalid certificate DER") {
        // bad cert bytes in membership; reconfigure with correct cert
        parseErr = comm.reconfigureWithValidCert(channel, id)
        return parseErr
    }
    return err
}

When it happens

Trigger: Calling Comm.Remote/CreateRemoteContext for a stub whose ServerTLSCert was populated with non-DER bytes - e.g. a PEM block (with headers) stored raw, a truncated certificate, or a non-certificate value.

Common situations: Misconfigured TLS root/consenter certificates in orderer config (channel config contains PEM instead of DER, or vice versa); corrupted channel config block; certificate field filled from the wrong config key; hand-edited or tool-mangled config updates.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• enrollment certificate is not a valid x509 certificate: %v
• subjectKeyIdentifier not found in certificate
• session binding read failed
• session binding mismatch
• forbidden pulling the channel

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/5115da48ed05919c. Report an issue: GitHub.