What causes "reading orderer CA certificate: %s" in hyperledger/fabric?

Verify the CA file exists and is readable: ls -l or cat it.

reading orderer CA certificate: %s

Error message

reading orderer CA certificate: %s

What it means

osnadmin (ordering node admin) loads the orderer's TLS CA certificate from --ca-file when establishing an HTTPS connection. If os.ReadFile on that PEM file fails, this error wraps the OS error and the command exits with status 1 before any request is sent. It is a file-access problem with the supplied CA certificate path.

Source

Thrown at cmd/osnadmin/main.go:93

		return "", 1, err
	}

	//
	// flag validation
	//
	var (
		osnURL        string
		caCertPool    *x509.CertPool
		tlsClientCert tls.Certificate
	)
	// TLS enabled
	if *caFile != "" {
		osnURL = fmt.Sprintf("https://%s", *orderer)
		var err error
		caCertPool = x509.NewCertPool()
		caFilePEM, err := os.ReadFile(*caFile)
		if err != nil {
			return "", 1, fmt.Errorf("reading orderer CA certificate: %s", err)
		}
		if !caCertPool.AppendCertsFromPEM(caFilePEM) {
			return "", 1, errors.New("failed to add ca-file PEM to cert pool")
		}

		tlsClientCert, err = tls.LoadX509KeyPair(*clientCert, *clientKey)
		if err != nil {
			return "", 1, fmt.Errorf("loading client cert/key pair: %s", err)
		}
	} else { // TLS disabled
		osnURL = fmt.Sprintf("http://%s", *orderer)
	}

	var marshaledConfigBlock []byte
	if *configBlockPath != "" {
		marshaledConfigBlock, err = os.ReadFile(*configBlockPath)
		if err != nil {
			return "", 1, fmt.Errorf("reading config block: %s", err)

View on GitHub (pinned to 2736b63f8f)

Solutions

Verify the CA file exists and is readable: ls -l <ca-file> or cat it.
Use an absolute path for --ca-file rather than a relative one.
In containers/k8s, confirm the secret/volume mounting the CA cert is present and mounted at the expected path.
Fix file permissions (chmod 644 on the CA cert is typical).

Example fix

// before
osnadmin channel list --orderer-address orderer:7053 --ca-file ./certs/ca.pem
// after
osnadmin channel list --orderer-address orderer:7053 --ca-file /etc/fabric/tls/ca.crt

Defensive patterns

Strategy: validation

Validate before calling

caFile := "/etc/fabric/tls/ca.crt"
if info, err := os.Stat(caFile); err != nil {
    log.Fatalf("ca-file missing: %v", err)
} else if info.IsDir() {
    log.Fatal("ca-file must be a file, not a directory")
}
if _, err := os.ReadFile(caFile); err != nil {
    log.Fatalf("ca-file unreadable: %v", err)
}

Prevention

Use absolute paths for --ca-file
Mount TLS secrets into containers before running osnadmin
Verify cert presence with ls/test in CI scripts
Keep CA certs world-readable (0644)

When it happens

Trigger: Running osnadmin channel join/list/remove with --ca-file pointing to a path that does not exist, is unreadable, or is a directory.

Common situations: Wrong path after moving TLS certs; secrets not mounted in a k8s pod; permission denied for the running user; typo'd path relative to cwd.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/b9a4ed732a7b1264. Report an issue: GitHub.