What causes "signature set did not satisfy policy" in hyperledger/fabric?

Audit the signature set against the policy rule (principals, MSP IDs, roles) and obtain the missing valid signatures

signature set did not satisfy policy

Error message

signature set did not satisfy policy

What it means

After the nil guard, EvaluateIdentities runs the compiled evaluator closure over the identity set; if it returns false, the supplied identities do not satisfy the signature policy and this error is returned.

Source

Thrown at common/cauthdsl/policy.go:105

	if p == nil {
		return errors.New("no such policy")
	}

	ids := policies.SignatureSetToValidIdentities(signatureSet, p.deserializer)

	return p.EvaluateIdentities(ids)
}

// EvaluateIdentities takes an array of identities and evaluates whether
// they satisfy the policy
func (p *policy) EvaluateIdentities(identities []msp.Identity) error {
	if p == nil {
		return fmt.Errorf("No such policy")
	}

	ok := p.evaluator(identities, make([]bool, len(identities)))
	if !ok {
		return errors.New("signature set did not satisfy policy")
	}
	return nil
}

func (p *policy) Convert() (*cb.SignaturePolicyEnvelope, error) {
	if p.signaturePolicyEnvelope == nil {
		return nil, errors.New("nil policy field")
	}

	return p.signaturePolicyEnvelope, nil
}

View on GitHub (pinned to 2736b63f8f)

Solutions

Audit the signature set against the policy rule (principals, MSP IDs, roles) and obtain the missing valid signatures
Compare the evaluated identities' MSP/OU/role against sigPolicy.Identities
Review the policy definition — it may be stricter (higher N, wrong principals) than intended

Example fix

// before
ids := []msp.Identity{peerOrgAIdentity} // policy requires majority of {A,B,C}
err := pol.EvaluateIdentities(ids) // fails
// after
ids := []msp.Identity{idA, idB} // satisfies NOutOf(2, {A,B,C})
err := pol.EvaluateIdentities(ids)

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-check: count identities matching the policy principals before evaluating
satisfied := countMatchingPrincipals(ids, env.Identities)
if satisfied < int(env.GetNOutOf().GetN()) {
    return fmt.Errorf("need %d matching identities, have %d", env.GetNOutOf().GetN(), satisfied)
}

Try / catch

if err := pol.EvaluateIdentities(ids); err != nil {
    if err.Error() == "signature set did not satisfy policy" {
        return fmt.Errorf("endorsement rejected: %w (check signers' MSP IDs and policy principals)", err)
    }
    return err
}

Prevention

Log the evaluated signature set (MSP IDs, roles) on rejection for diagnosis
Keep chaincode endorsement policies aligned with collection/private-data policies
Verify identity validity (cert expiry, MSP enrollment) before evaluation

When it happens

Trigger: Calling EvaluateIdentities (directly or via EvaluateSignedData) with identities that fail the policy rule — wrong org principals, expired/invalid MSP identities, missing signatures, or an NOutOf threshold not met.

Common situations: Endorsement submissions where the endorsing peers' orgs differ from those required by the chaincode policy; identities from an MSP not listed in the policy; signature count below the NOutOf threshold.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/644e217b4b2d50c6. Report an issue: GitHub.