hyperledger/fabric · error

server root CA cert is nil

Error message

server root CA cert is nil

What it means

ConnectionsMgr.Connect dials a remote orderer and requires the server's root CA certificate(s) to authenticate TLS. Passing a nil serverRootCACert slice means there is nothing to verify the server against, so Connect fails fast before dialing.

Source

Thrown at orderer/common/cluster/connectionsmgr.go:44

}

func (cbc ConnectionsCache) Remove(key string) {
	delete(cbc, key)
}

func (cbc ConnectionsCache) Size() int {
	return len(cbc)
}

type ConnectionsMgr struct {
	lock        sync.RWMutex
	Connections ConnectionsCache
	dialer      comm.ClientConfig
}

func (c *ConnectionsMgr) Connect(endpoint string, serverRootCACert [][]byte) (*grpc.ClientConn, error) {
	if serverRootCACert == nil {
		return nil, errors.New("server root CA cert is nil")
	}

	c.lock.Lock()
	conn, alreadyConnected := c.Connections.Lookup(endpoint)
	if alreadyConnected {
		c.lock.Unlock()
		return conn, nil
	}
	dialer := c.dialer
	c.lock.Unlock()

	dialer.SecOpts.ServerRootCAs = serverRootCACert
	newConn, err := dialer.Dial(endpoint)
	if err != nil {
		return nil, err
	}

	c.lock.Lock()

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Populate serverRootCACert with the channel's Orderer TLS root certs from the latest config block
2. Ensure the channel config (tls.rootCerts) is loaded before calling Connect
3. If TLS is disabled intentionally, configure the dialer/comm.ClientConfig accordingly instead of passing a nil CA

Example fix

// before
conn, err := mgr.Connect(endpoint, nil)
// after
if len(tlsCACerts) == 0 {
    return nil, errors.New("no TLS CA certs in channel config")
}
conn, err := mgr.Connect(endpoint, tlsCACerts)

if len(serverRootCACert) == 0 {
    return nil, fmt.Errorf("cannot connect: no server root CA certs available")
}
conn, err := mgr.Connect(endpoint, serverRootCACert)

func hasRootCACerts(certs [][]byte) bool {
    return len(certs) > 0 && len(certs[0]) > 0
}

conn, err := mgr.Connect(endpoint, caCerts)
if err != nil {
    if strings.Contains(err.Error(), "root CA cert is nil") {
        return nil, fmt.Errorf("channel config missing TLS root certs: %w", err)
    }
    return nil, err
}

When it happens

Trigger: Calling Connect(endpoint, nil), typically when the caller's channel config yielded no TLS CA certs (e.g. empty tls.rootCerts in the channel config or config not yet loaded).

Common situations: Channel config block not yet retrieved/parsed so rootCerts is empty; channel configured without TLS while the orderer cluster uses mutual TLS; a bug in config propagation leaving the cert field unset.

Related errors

• client didn't include its TLS cert hash
• client didn't send a TLS certificate
• claimed TLS cert hash is %v but actual TLS cert hash is %v
• failed to access client TLS configuration: %w
• failed connecting to discovery service

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/54affaaed6bafd86. Report an issue: GitHub.