hyperledger/fabric · error

no client root certificates found

Error message

no client root certificates found

What it means

appendClientRootCA guard: the PEM blob parsed into zero certificates (pemToX509Certs succeeded but returned an empty list), so the clientRoot bytes contain no usable CA certificate even though they may be valid PEM of another type.

Source

Thrown at internal/pkg/comm/server.go:247

		)
	}
	return gServer.server.Serve(gServer.listener)
}

// Stop stops the underlying grpc.Server
func (gServer *GRPCServer) Stop() {
	gServer.server.Stop()
}

// internal function to add a PEM-encoded clientRootCA
func (gServer *GRPCServer) appendClientRootCA(clientRoot []byte) error {
	certs, err := pemToX509Certs(clientRoot)
	if err != nil {
		return errors.WithMessage(err, "failed to append client root certificate(s)")
	}

	if len(certs) < 1 {
		return errors.New("no client root certificates found")
	}

	for _, cert := range certs {
		gServer.tls.AddClientRootCA(cert)
	}

	return nil
}

// parse PEM-encoded certs
func pemToX509Certs(pemCerts []byte) ([]*x509.Certificate, error) {
	var certs []*x509.Certificate

	// it's possible that multiple certs are encoded
	for len(pemCerts) > 0 {
		var block *pem.Block
		block, pemCerts = pem.Decode(pemCerts)
		if block == nil {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Ensure the configured client root CA file contains at least one CERTIFICATE PEM block
2. Remove unrelated PEM blocks (e.g., keys) from the CA file

When it happens

Trigger: Thrown at internal/pkg/comm/server.go:247 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d5f4b66f7706e5d3. Report an issue: GitHub.