hyperledger/fabric · error

parsing tls intermediate certs

Error message

parsing tls intermediate certs

What it means

createX509VerifyOptions also parses each orderer org's TLS intermediate certs via parseCertificateListFromBytes; a malformed entry there is wrapped with 'parsing tls intermediate certs'. Same root cause family as the root-cert error but for the intermediate CA chain, raised during ValidateConsensusMetadata or IsChannelMember when building the x509 verify pools.

Source

Thrown at orderer/consensus/etcdraft/util.go:298

		certificateList = append(certificateList, certificate)
	}

	return certificateList, nil
}

func createX509VerifyOptions(ordererConfig channelconfig.Orderer) (x509.VerifyOptions, error) {
	tlsRoots := x509.NewCertPool()
	tlsIntermediates := x509.NewCertPool()

	for _, org := range ordererConfig.Organizations() {
		rootCerts, err := parseCertificateListFromBytes(org.MSP().GetTLSRootCerts())
		if err != nil {
			return x509.VerifyOptions{}, errors.Wrap(err, "parsing tls root certs")
		}
		intermediateCerts, err := parseCertificateListFromBytes(org.MSP().GetTLSIntermediateCerts())
		if err != nil {
			return x509.VerifyOptions{}, errors.Wrap(err, "parsing tls intermediate certs")
		}

		for _, cert := range rootCerts {
			tlsRoots.AddCert(cert)
		}

		for _, cert := range intermediateCerts {
			tlsIntermediates.AddCert(cert)
		}
	}

	return x509.VerifyOptions{
		Roots:         tlsRoots,
		Intermediates: tlsIntermediates,
		KeyUsages: []x509.ExtKeyUsage{
			x509.ExtKeyUsageClientAuth,
			x509.ExtKeyUsageServerAuth,
		},

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Validate every file in the org's msp/tls/intermediatecerts with openssl x509 and replace/repair the bad one, then update channel config
2. Enumerate GetTLSIntermediateCerts per org and parse each individually to find the failing cert
3. If the TLS chain has no intermediates, remove the invalid entry or empty directory instead of shipping junk bytes
4. Regenerate intermediate CA material from fabric-ca and rebuild the MSP definition

Example fix

// before: directory contents shipped blindly into MSP config
intermediateCerts: file("crypto-config/ordererOrganizations/example.com/msp/tls/intermediatecerts/*")
// after: only verified PEM certificates included
intermediateCerts: [certFor("intermediate.crt")] // checked with: openssl x509 -in intermediate.crt -noout

// validate org TLS intermediate certs before building verify options
for _, org := range ordererConfig.Organizations() {
    for i, ic := range org.MSP().GetTLSIntermediateCerts() {
        if !isPEMCertificate(ic) {
            return fmt.Errorf("org %s tls intermediate cert[%d] is not valid PEM", org.Name(), i)
        }
    }
}

func isPEMCertificate(b []byte) bool {
    block, _ := pem.Decode(b)
    return block != nil && block.Type == "CERTIFICATE"
}

opts, err := createX509VerifyOptions(cfg)
if err != nil {
    if strings.Contains(err.Error(), "parsing tls intermediate certs") {
        return fmt.Errorf("invalid TLS intermediate cert in orderer org MSP: %w", err)
    }
    return err
}

When it happens

Trigger: Channel config for etcdraft consensus contains an orderer org whose MSP GetTLSIntermediateCerts returns at least one byte slice that is not a valid PEM DER X.509 certificate (call chain: createX509VerifyOptions -> parseCertificateListFromBytes -> parseCertificateFromBytes).

Common situations: An org configured intermediates field pointing at files that are not certs (CRLs, keys, signatures); intermediate CA cert re-exported/damaged; mixing TLS vs TLS-CA material from different crypto generations.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• parsing tls root certs
• failed deserializing signed data identity during channelless
• parseCertificate failed
• subjectKeyIdentifier not found in certificate
• %s TLS certificate has invalid ASN1 structure %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/c340e5dd6efcb038. Report an issue: GitHub.