hyperledger/fabric · error

subjectKeyIdentifier not found in certificate

Error message

subjectKeyIdentifier not found in certificate

What it means

The MSP X.509 validation code extracts the Subject Key Identifier (SKI, the subjectKeyIdentifier extension, OID 2.5.29.14) from a certificate to build/validate certificate chains. If the certificate carries no SKI extension, getSubjectKeyIdentifierFromCert returns this error and chain validation fails. Per RFC 5280 CA certificates should always have an SKI, so its absence indicates a malformed or non-compliant certificate.

Source

Thrown at msp/mspimplvalidate.go:370

// getSubjectKeyIdentifierFromCert returns the Subject Key Identifier for the supplied certificate
// Subject Key Identifier is an identifier of the public key of this certificate
func getSubjectKeyIdentifierFromCert(cert *x509.Certificate) ([]byte, error) {
	var SKI []byte

	for _, ext := range cert.Extensions {
		// Subject Key Identifier is identified by the following ASN.1 tag
		// subjectKeyIdentifier (2 5 29 14) (see https://tools.ietf.org/html/rfc3280.html)
		if reflect.DeepEqual(ext.Id, asn1.ObjectIdentifier{2, 5, 29, 14}) {
			_, err := asn1.Unmarshal(ext.Value, &SKI)
			if err != nil {
				return nil, errors.Wrap(err, "failed to unmarshal Subject Key Identifier")
			}

			return SKI, nil
		}
	}

	return nil, errors.New("subjectKeyIdentifier not found in certificate")
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Regenerate the certificate with the subjectKeyIdentifier extension enabled (openssl x509 extensions: subjectKeyIdentifier=hash)
2. If regenerating, re-issue with standard tooling (cryptogen, Fabric CA, or cfssl) which include SKI by default
3. Verify the cert with `openssl x509 -in cert.pem -text` and check for 'Subject Key Identifier' before enrolling it in the MSP
4. If the cert comes from an external CA, request a compliant re-issuance per RFC 5280

Example fix

# before (openssl.cnf missing SKI)
# basicConstraints = critical,CA:true
# after
basicConstraints = critical,CA:true
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer

func hasSKI(cert *x509.Certificate) bool {
	for _, oid := range cert.Extensions {
		if oid.Id.Equal(oidSubjectKeyIdentifier) { return true }
	}
	return false
}
// reject CA certs where !hasSKI(cert) before adding them to the MSP

if _, err := getSubjectKeyIdentifierFromCert(cert); err != nil {
	return fmt.Errorf("certificate %s lacks subjectKeyIdentifier: regenerate with SKI", cert.Subject)
}

When it happens

Trigger: Calling finalizeSetupCAs, setupTLSCAs, or validateCertAgainstChain with a CA or intermediate certificate that lacks the subjectKeyIdentifier extension (e.g. certs generated by non-standard or very old tooling, or hand-crafted certs).

Common situations: Custom CA certificates generated without the SKI extension (openssl config missing subjectKeyIdentifier=hash), certs from legacy/proprietary CAs, or certificates edited/re-issued incorrectly; often surfaces when adding an org or TLS CA to the channel MSP.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed deserializing signed data identity during channelless
• getCertFromPem error: failed to parse x509 cert
• parseCertificate failed
• invalid certificate DER
• parsing tls root certs

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/fd2add284ea8eeef. Report an issue: GitHub.