hyperledger/fabric · error

proposal client identity expired

Error message

proposal client identity expired

What it means

The expiration filter extracted the creator identity and found its certificate expiration time is non-zero and in the past — the submitting client's certificate has expired, so the proposal is denied authentication.

Source

Thrown at core/handlers/auth/filter/expiration.go:51

func validateProposal(signedProp *peer.SignedProposal) error {
	prop, err := protoutil.UnmarshalProposal(signedProp.ProposalBytes)
	if err != nil {
		return errors.Wrap(err, "failed parsing proposal")
	}

	hdr, err := protoutil.UnmarshalHeader(prop.Header)
	if err != nil {
		return errors.Wrap(err, "failed parsing header")
	}

	sh, err := protoutil.UnmarshalSignatureHeader(hdr.SignatureHeader)
	if err != nil {
		return errors.Wrap(err, "failed parsing signature header")
	}
	expirationTime := crypto.ExpiresAt(sh.Creator)
	if !expirationTime.IsZero() && time.Now().After(expirationTime) {
		return errors.New("proposal client identity expired")
	}
	return nil
}

// ProcessProposal processes a signed proposal
func (f *expirationCheckFilter) ProcessProposal(ctx context.Context, signedProp *peer.SignedProposal) (*peer.ProposalResponse, error) {
	if err := validateProposal(signedProp); err != nil {
		return nil, err
	}
	return f.next.ProcessProposal(ctx, signedProp)
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Renew or replace the client's MSP certificate and retry
2. Re-enroll the client identity with a valid CA

When it happens

Trigger: Thrown at core/handlers/auth/filter/expiration.go:51 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/be1e4271cbb779b1. Report an issue: GitHub.