hyperledger/fabric · error

sanitizeCert failed %s

Error message

sanitizeCert failed %s

What it means

After parsing the certificate, getCertifiersIdentifier sanitizes it (converting to the internal crypto provider's expected format) via sanitizeCert. If sanitization fails, setup cannot proceed with OU classification and this error is returned wrapping the underlying cause.

Source

Thrown at msp/mspimplsetup.go:34

	"github.com/hyperledger/fabric-lib-go/bccsp"
	"github.com/hyperledger/fabric-lib-go/bccsp/utils"
	m "github.com/hyperledger/fabric-protos-go-apiv2/msp"
	"github.com/pkg/errors"
	"google.golang.org/protobuf/proto"
)

func (msp *bccspmsp) getCertifiersIdentifier(certRaw []byte) ([]byte, error) {
	// 1. check that certificate is registered in msp.rootCerts or msp.intermediateCerts
	cert, err := msp.getCertFromPem(certRaw)
	if err != nil {
		return nil, fmt.Errorf("Failed getting certificate for [%v]: [%s]", certRaw, err)
	}

	// 2. Sanitize it to ensure like for like comparison
	cert, err = msp.sanitizeCert(cert)
	if err != nil {
		return nil, fmt.Errorf("sanitizeCert failed %s", err)
	}

	found := false
	root := false
	// Search among root certificates
	for _, v := range msp.rootCerts {
		if v.(*identity).cert.Equal(cert) {
			found = true
			root = true
			break
		}
	}
	if !found {
		// Search among root intermediate certificates
		for _, v := range msp.intermediateCerts {
			if v.(*identity).cert.Equal(cert) {
				found = true
				break

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Read the wrapped cause to identify whether the signature algorithm or key type is unsupported
2. Re-issue the certificate with an ECDSA (or supported RSA) signature algorithm
3. Ensure the BCCSP configuration (mspConfigPath / bccsp section) matches the certificate types in use
4. Upgrade Fabric to a version supporting the certificate's algorithm

block, _ := pem.Decode(certRaw)
cert, err := x509.ParseCertificate(block.Bytes)
if err == nil {
    fmt.Println(cert.PublicKeyAlgorithm, cert.SignatureAlgorithm) // confirm supported
}

func isSupportedSignature(alg x509.SignatureAlgorithm) bool {
    switch alg {
    case x509.ECDSAWithSHA256, x509.ECDSAWithSHA384, x509.ECDSAWithSHA512, x509.SHA256WithRSA, x509.SHA384WithRSA, x509.SHA512WithRSA:
        return true
    }
    return false
}

if err := mspSetup(...); err != nil {
    if strings.Contains(err.Error(), "sanitizeCert failed") {
        // re-issue certs with supported algorithms or adjust BCCSP config
    }
}

When it happens

Trigger: sanitizeCert fails on a certificate that parsed but has unsupported signature algorithm, unsupported public key type, or fails re-encoding under the configured BCCSP provider (e.g. SW vs PKCS11).

Common situations: Certificates signed with unusual algorithms (e.g. RSA-PSS or Ed25519 unsupported by the BCCSP version), mixed PKCS11 HSM setups, certificates produced by non-standard CAs, Fabric version mismatch where sanitization expectations differ.

Related errors

• public keys do not match
• failed to PEM decode identity bytes: %s
• failed parsing certificate %s
• failed unmarshaling ECDSA signature on identity: %s
• Could not sign the ccpackage, err %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/dcdb0c8053f66a91. Report an issue: GitHub.