hyperledger/fabric · error

key extraction failed

Error message

key extraction failed

What it means

After PEM decoding succeeds, VerifySignature parses the DER bytes as an X.509 certificate. x509.ParseCertificate failure is wrapped with this message, meaning the block existed but its payload is not a well-formed certificate.

Source

Thrown at orderer/common/cluster/util.go:721

	connState := peerInfo.AuthInfo.(credentials.TLSInfo).State

	tlsBinding, err := exportKM(connState, KeyingMaterialLabel, bindingPayload)
	if err != nil {
		return nil, errors.Wrap(err, "failed exporting keying material")
	}

	return tlsBinding, nil
}

func VerifySignature(identity, msgHash, signature []byte) error {
	block, _ := pem.Decode(identity)
	if block == nil {
		return errors.New("pem decoding failed")
	}

	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return errors.Wrap(err, "key extraction failed")
	}

	pubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)
	if !isECDSA {
		return errors.New("not valid public key")
	}

	validSignature := ecdsa.VerifyASN1(pubKey, msgHash, signature)

	if !validSignature {
		return errors.New("signature invalid")
	}
	return nil
}

func SHA256Digest(data []byte) []byte {
	hash := sha256.Sum256(data)
	return hash[:]

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Confirm the PEM block type is CERTIFICATE (openssl x509 -in file -noout -text should succeed)
2. Replace the file with the correct certificate (not key or CSR)
3. Regenerate/re-export the certificate; avoid editing cert files manually (trailing whitespace/newline corruption)
4. Check the inner wrapped error for the specific ASN.1 parse problem (e.g. truncated, unknown critical extension)

blk, _ := pem.Decode(identityPEM)
if blk == nil { return errors.New("not PEM") }
if _, err := x509.ParseCertificate(blk.Bytes); err != nil {
    return fmt.Errorf("identity PEM payload is not a valid certificate: %w", err)
}

func isParseableCertPEM(data []byte) bool {
    blk, _ := pem.Decode(data)
    if blk == nil { return false }
    _, err := x509.ParseCertificate(blk.Bytes)
    return err == nil
}

err := cluster.VerifySignature(identityPEM, hash, sig)
if err != nil && strings.Contains(err.Error(), "key extraction failed") {
    return fmt.Errorf("identity file is not a certificate (wrong file or corrupt): %w", err)
}

When it happens

Trigger: PEM block contains a non-certificate (private key, public key, CSR) so its DER payload fails certificate parsing; truncated or corrupted certificate bytes; an unrecognized extension marked critical that the local crypto/x509 rejects.

Common situations: Pointing config at a private-key PEM instead of the certificate; certificates generated with non-standard encodings; damaged files transferred via copy/paste or wrong mount.

Related errors

• enrollment certificate is not a valid x509 certificate: %v
• public keys do not match
• failed to PEM decode identity bytes: %s
• failed parsing certificate %s
• failed marshaling ECDSA signature

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/47820f6cc01badf2. Report an issue: GitHub.