hyperledger/fabric · error

public key transition failed: %w

Error message

public key transition failed: %w

What it means

computeSKI derives the Subject Key Identifier per RFC 7093 Method 4 by converting the ECDSA public key to an ECDH key (key.ECDH()). If the key cannot be converted (unsupported curve or non-ECDH-compatible key), this wrapped error is returned.

Source

Thrown at common/crypto/tlsgen/key.go:127

	}
	privKey := encodePEM("EC PRIVATE KEY", privBytes)
	return &CertKeyPair{
		Key:     privKey,
		Cert:    pubKey,
		Signer:  privateKey,
		TLSCert: cert,
	}, nil
}

func encodePEM(keyType string, data []byte) []byte {
	return pem.EncodeToMemory(&pem.Block{Type: keyType, Bytes: data})
}

// RFC 7093, Section 2, Method 4
func computeSKI(key *ecdsa.PublicKey) ([]byte, error) {
	ecdhPk, err := key.ECDH()
	if err != nil {
		return nil, fmt.Errorf("public key transition failed: %w", err)
	}

	hash := sha256.Sum256(ecdhPk.Bytes())
	return hash[:], nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Use a standard curve: P-256 (ECDSA), P-384, or P-521 for the CA key
2. Check the curve configured in your CA setup code/fabric.yaml and switch to elliptic.P256()
3. Regenerate key material with a supported curve

Example fix

// before
priv, _ := ecdsa.GenerateKey(elliptic.P224(), rand.Reader)
ca, err := tlsgen.NewCA(priv) // fails in computeSKI
// after
priv, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
ca, err := tlsgen.NewCA(priv)

func isSupportedCurve(curve elliptic.Curve) bool {
    switch curve {
    case elliptic.P256(), elliptic.P384(), elliptic.P521():
        return true
    }
    return false
}

ca, err := tlsgen.NewCA()
if err != nil && strings.Contains(err.Error(), "public key transition failed") {
    return fmt.Errorf("unsupported CA key curve: %w", err)
}

When it happens

Trigger: newCertKeyPair generating a certificate whose ECDSA public key uses a curve not supported by crypto/ecdh (e.g., P-224/secp224r1 or other exotic curves).

Common situations: Configuring a CA with a custom curve; older key material using curves outside P-256/P-384/P-521.

Related errors

• found unknown private key type (%T) in msg signing
• found unknown private key type (%T) in PKCS#8 wrapping
• failed to parse private key: %v
• Unknown hashing algorithm type: %s
• error getting random bytes

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d4df8e001345b4bb. Report an issue: GitHub.