hyperledger/fabric · error

The certificate has been revoked

Error message

The certificate has been revoked

What it means

validateCertAgainstChain guard: the certificate under validation is listed in a CRL that was signed by the issuing CA (signature already verified via CheckCRLSignature). The identity has been revoked and fails validation; the revocation is effective per the CRL's revocation time semantics.

Source

Thrown at msp/mspimplvalidate.go:143

					// certificate that is under validation. As a
					// precaution, we verify that said CA is also the
					// signer of this CRL.
					err = validationChain[1].CheckCRLSignature(crl)
					if err != nil {
						// the CA cert that signed the certificate
						// that is under validation did not sign the
						// candidate CRL - skip
						mspLogger.Warningf("Invalid signature over the identified CRL, error %+v", err)
						continue
					}

					// A CRL also includes a time of revocation so that
					// the CA can say "this cert is to be revoked starting
					// from this time"; however here we just assume that
					// revocation applies instantaneously from the time
					// the MSP config is committed and used so we will not
					// make use of that field
					return errors.New("The certificate has been revoked")
				}
			}
		}
	}

	return nil
}

func (msp *bccspmsp) validateIdentityOUsV1(id *identity) error {
	// Check that the identity's OUs are compatible with those recognized by this MSP,
	// meaning that the intersection is not empty.
	if len(msp.ouIdentifiers) > 0 {
		found := false

		for _, OU := range id.GetOrganizationalUnits() {
			certificationIDs, exists := msp.ouIdentifiers[OU.OrganizationalUnitIdentifier]

			if exists {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Reissue a new certificate for the identity from the CA
2. Remove the stale CRL from the MSP's RevocationList if the revocation was mistaken
3. Track the CRL update so peers and orderers pick up the corrected revocation list

When it happens

Trigger: Thrown at msp/mspimplvalidate.go:143 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/d006154b342e693c. Report an issue: GitHub.