number of peer addresses (%d) does not match the number of T

Error message

number of peer addresses (%d) does not match the number of TLS root cert files (%d)

What it means

validatePeerConnectionParameters enforces that when peer TLS is enabled (peer.tls.enabled), the number of --tlsRootCertFiles must exactly equal the number of --peerAddresses, since each peer connection needs its own CA cert. A mismatch is a hard error; more certs than addresses is only a warning when TLS is off.

Source

Thrown at internal/peer/chaincode/common.go:349

		}
	}

	// currently only support multiple peer addresses for invoke
	multiplePeersAllowed := map[string]bool{
		"invoke": true,
	}
	_, ok := multiplePeersAllowed[cmdName]
	if !ok && len(peerAddresses) > 1 {
		return errors.Errorf("'%s' command can only be executed against one peer. received %d", cmdName, len(peerAddresses))
	}

	if len(tlsRootCertFiles) > len(peerAddresses) {
		logger.Warningf("received more TLS root cert files (%d) than peer addresses (%d)", len(tlsRootCertFiles), len(peerAddresses))
	}

	if viper.GetBool("peer.tls.enabled") {
		if len(tlsRootCertFiles) != len(peerAddresses) {
			return errors.Errorf("number of peer addresses (%d) does not match the number of TLS root cert files (%d)", len(peerAddresses), len(tlsRootCertFiles))
		}
	} else {
		tlsRootCertFiles = nil
	}

	return nil
}

// ChaincodeCmdFactory holds the clients used by ChaincodeCmd
type ChaincodeCmdFactory struct {
	EndorserClients []pb.EndorserClient
	DeliverClients  []pb.DeliverClient
	Certificate     tls.Certificate
	Signer          identity.SignerSerializer
	BroadcastClient common.BroadcastClient
}

// InitCmdFactory init the ChaincodeCmdFactory with default clients

View on GitHub (pinned to 2736b63f8f)

Solutions

Supply one --tlsRootCertFiles flag per --peerAddresses flag, in matching order
Verify counts match: count --peerAddresses and --tlsRootCertFiles occurrences in the command
If TLS is disabled, ensure peer.tls.enabled is false consistently on the CLI node
Obtain the correct CA cert path for each org's peer from the connection profile

Example fix

// before
peer chaincode invoke -C mychannel -n mycc -c '{"Args":["Invoke"]}' --peerAddresses peer0.org1:7051 --peerAddresses peer0.org2:8051 --tlsRootCertFiles /certs/org1-ca.crt
// after
peer chaincode invoke -C mychannel -n mycc -c '{"Args":["Invoke"]}' --peerAddresses peer0.org1:7051 --peerAddresses peer0.org2:8051 --tlsRootCertFiles /certs/org1-ca.crt --tlsRootCertFiles /certs/org2-ca.crt

Defensive patterns

Strategy: validation

Validate before calling

NADDR=$(grep -o -- '--peerAddresses' <<<"$CMD" | wc -l); NCERT=$(grep -o -- '--tlsRootCertFiles' <<<"$CMD" | wc -l); [[ $NADDR -eq $NCERT ]] || { echo "peer addresses ($NADDR) != tls certs ($NCERT)"; exit 1; }

Prevention

Always pair each --peerAddresses with a --tlsRootCertFiles in the same order
Generate TLS flags from a single source list so counts can't diverge
Confirm peer.tls.enabled matches your deployment; disable the flag pairing only when TLS is truly off
Keep per-org CA cert paths in a config file and loop over them when composing the command

When it happens

Trigger: Running a peer chaincode command with peer.tls.enabled where len(tlsRootCertFiles) != len(peerAddresses) — e.g. supplying two peer addresses but one, or zero, --tlsRootCertFiles flags.

Common situations: Adding a peer address for multi-endorsement invoke but forgetting to add the matching TLS CA cert file, switching a script from non-TLS to TLS without adding certs, typos dropping one of repeated --tlsRootCertFiles flags.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/27805ed9aeb5463d. Report an issue: GitHub.