What causes "not valid public key" in hyperledger/fabric?

Issue/use an ECDSA certificate (e.g. P-256) for the node identity

not valid public key

Error message

not valid public key

What it means

VerifySignature only supports ECDSA signers. After extracting the certificate's public key, a type assertion to *ecdsa.PublicKey is performed; if the certificate was signed with (or carries) an RSA or Ed25519 public key, the assertion fails and this error is returned.

Source

Thrown at orderer/common/cluster/util.go:726

	}

	return tlsBinding, nil
}

func VerifySignature(identity, msgHash, signature []byte) error {
	block, _ := pem.Decode(identity)
	if block == nil {
		return errors.New("pem decoding failed")
	}

	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return errors.Wrap(err, "key extraction failed")
	}

	pubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)
	if !isECDSA {
		return errors.New("not valid public key")
	}

	validSignature := ecdsa.VerifyASN1(pubKey, msgHash, signature)

	if !validSignature {
		return errors.New("signature invalid")
	}
	return nil
}

func SHA256Digest(data []byte) []byte {
	hash := sha256.Sum256(data)
	return hash[:]
}

// VerifyBlocksBFT verifies the given consecutive sequence of blocks is valid, always verifies signature,
// and returns nil if it's valid, else an error.
func VerifyBlocksBFT(blocks []*common.Block, signatureVerifier protoutil.BlockVerifierFunc, vb protoutil.VerifierBuilder) error {

View on GitHub (pinned to 2736b63f8f)

Solutions

Issue/use an ECDSA certificate (e.g. P-256) for the node identity
Set the MSP/crypto-config key algorithm to ecdsa and re-enroll the identity
If RSA/Ed25519 support is required, extend VerifySignature to branch on cert.PublicKey type and use rsa.VerifyPKCS1v15 or ed25519.Verify accordingly
Check the inner CA and leaf use the same algorithm family

Example fix

// before
pubKey, isECDSA := cert.PublicKey.(*ecdsa.PublicKey)
if !isECDSA {
    return errors.New("not valid public key")
}
// after
switch pub := cert.PublicKey.(type) {
case *ecdsa.PublicKey:
    valid := ecdsa.VerifyASN1(pub, msgHash, signature)
case ed25519.PublicKey:
    valid := ed25519.Verify(pub, msgHash, signature)
default:
    return errors.New("unsupported public key algorithm")
}

Defensive patterns

Strategy: validation

Validate before calling

blk, _ := pem.Decode(certPEM)
cert, err := x509.ParseCertificate(blk.Bytes)
if err != nil { return err }
if _, ok := cert.PublicKey.(*ecdsa.PublicKey); !ok {
    return fmt.Errorf("cert public key is %v, ECDSA required", cert.PublicKeyAlgorithm)
}

Type guard

func isECDSACertPEM(data []byte) bool {
    blk, _ := pem.Decode(data)
    if blk == nil { return false }
    cert, err := x509.ParseCertificate(blk.Bytes)
    if err != nil { return false }
    _, ok := cert.PublicKey.(*ecdsa.PublicKey)
    return ok
}

Try / catch

err := cluster.VerifySignature(identityPEM, hash, sig)
if err != nil && strings.Contains(err.Error(), "not valid public key") {
    return fmt.Errorf("identity is not an ECDSA certificate; re-enroll with ecdsa: %w", err)
}

Prevention

Configure crypto-config/MSP with PublicKeyAlgorithm ecdsa before enrolling
Check leaf and CA algorithms match (openssl x509 -text | grep 'Public Key Algorithm')
Standardize on ECDSA P-256 across the network
Document algorithm requirements in deployment configs

When it happens

Trigger: Calling VerifySignature with an identity certificate whose public key algorithm is RSA, Ed25519, or ECDSA-with-different-curve that isn't *ecdsa.PublicKey — the signature may even be valid, but the verifier refuses non-ECDSA keys.

Common situations: Fabric network deployed with RSA certificates (e.g. certs issued by a corporate CA defaulting to RSA) where the cluster verification path expects ECDSA; MSP crypto config switched between ecdsa and rsa after enrollment.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/977c75e4c309d3b5. Report an issue: GitHub.