hyperledger/fabric · error

signing failed

Error message

signing failed

What it means

After building the ASN.1-encoded AuthRequestSignature fields, Auth() invokes cs.Signer.Sign(asnSignFields) to sign the authentication request. If the signer returns an error it is wrapped as 'signing failed'. The stream's signing identity could not produce a signature over the auth payload.

Source

Thrown at orderer/common/cluster/commauth.go:281

	bindingFieldsHash := GetSessionBindingHash(payload)

	tlsBinding, err := GetTLSSessionBinding(cs.StepClient.Context(), bindingFieldsHash)
	if err != nil {
		return errors.Wrap(err, "TLSBinding failed")
	}
	payload.SessionBinding = tlsBinding

	asnSignFields, _ := asn1.Marshal(AuthRequestSignature{
		Version:        int64(payload.Version),
		Timestamp:      EncodeTimestamp(payload.Timestamp),
		FromId:         strconv.FormatUint(payload.FromId, 10),
		ToId:           strconv.FormatUint(payload.ToId, 10),
		SessionBinding: payload.SessionBinding,
		Channel:        payload.Channel,
	})
	sig, err := cs.Signer.Sign(asnSignFields)
	if err != nil {
		return errors.Wrap(err, "signing failed")
	}

	payload.Signature = sig
	stepRequest := &orderer.ClusterNodeServiceStepRequest{
		Payload: &orderer.ClusterNodeServiceStepRequest_NodeAuthrequest{
			NodeAuthrequest: payload,
		},
	}

	return cs.StepClient.Send(stepRequest)
}

func (cs *NodeClientStream) Context() context.Context {
	return cs.StepClient.Context()
}

func BuildStepRequest(request *orderer.StepRequest) (*orderer.ClusterNodeServiceStepRequest, error) {
	if request == nil {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Inspect the wrapped underlying error (errors.Wrap preserves it) to identify the crypto-provider failure and fix that root cause.
2. Verify the BCCSP/keystore configuration (msp directory, bccsp section) and that the private key file is present and readable.
3. If using HSM, confirm the PKCS11 library path, PIN, and slot configuration are correct and the HSM is reachable.
4. Regenerate/re-enroll the orderer's signing identity if the key material is corrupt.

if stream != nil && stream.Signer != nil {
    // signer present; still verify key availability at startup
    if err := verifySignerUsable(stream.Signer); err != nil {
        return err
    }
}

if err := stream.Auth(); err != nil {
    if strings.Contains(err.Error(), "signing failed") {
        // inspect wrapped cause; check BCCSP/HSM health before retry
        return fmt.Errorf("auth signing: %w", err)
    }
    return err
}

When it happens

Trigger: Calling Auth() where cs.Signer.Sign fails — e.g. the signing identity's private key is unavailable, the crypto provider (HSM/PKCS11, software keystore) returns an error, or the MSP signing identity is malformed/expired.

Common situations: BCCSP configured for PKCS11 with an unreachable HSM; corrupted or missing keystore files; signing identity loaded from the wrong MSP directory; key type not supported by the configured crypto provider.

Related errors

• Could not sign the ccpackage, err %s
• cannot create signed proposal, due to %s
• Cannot create signed proposal, due to %s
• found unknown private key type (%T) in msg signing
• found unknown private key type (%T) in PKCS#8 wrapping

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d12a5bf919dc829d. Report an issue: GitHub.