What causes "The identities do not match" in hyperledger/fabric?

Sign/submit the operation with the exact identity whose certificate is embedded in the policy principal

The identities do not match

Error message

The identities do not match

What it means

Thrown when a policy principal of classification IDENTITY is being satisfied: the principal's certificate bytes were deserialized successfully, but they differ byte-for-byte from the raw certificate of the identity being checked. The library requires an exact certificate match for identity principals; there is no partial or alias matching.

Source

Thrown at msp/mspimpl.go:546

				return errors.Wrapf(err, "The identity is not a [%s] under this MSP [%s]", m.MSPRole_MSPRoleType_name[int32(mspRole.Role)], msp.name)
			}
			return nil
		default:
			return errors.Errorf("invalid MSP role type %d", int32(mspRole.Role))
		}
	case m.MSPPrincipal_IDENTITY:
		// in this case we have to deserialize the principal's identity
		// and compare it byte-by-byte with our cert
		principalId, err := msp.DeserializeIdentity(principal.Principal)
		if err != nil {
			return errors.WithMessage(err, "invalid identity principal, not a certificate")
		}

		if bytes.Equal(id.(*identity).cert.Raw, principalId.(*identity).cert.Raw) {
			return principalId.Validate()
		}

		return errors.New("The identities do not match")
	case m.MSPPrincipal_ORGANIZATION_UNIT:
		// Principal contains the OrganizationUnit
		OU := &m.OrganizationUnit{}
		err := proto.Unmarshal(principal.Principal, OU)
		if err != nil {
			return errors.Wrap(err, "could not unmarshal OrganizationUnit from principal")
		}

		// at first, we check whether the MSP
		// identifier is the same as that of the identity
		if OU.MspIdentifier != msp.name {
			return errors.Errorf("the identity is a member of a different MSP (expected %s, got %s)", OU.MspIdentifier, id.GetMSPIdentifier())
		}

		// we then check if the identity is valid with this MSP
		// and fail if it is not
		err = msp.Validate(id)
		if err != nil {

View on GitHub (pinned to 2736b63f8f)

Solutions

Sign/submit the operation with the exact identity whose certificate is embedded in the policy principal
Update the policy's IDENTITY principal bytes to the current signer's cert if the identity was rotated
Verify you are using the enrollment (signing) certificate, not the TLS certificate
Check that no intermediate transformation (PEM vs DER) changed the principal's cert bytes

Example fix

// before: policy pins admin cert, client signs with ordinary member cert
policy := &msp.MSPPrincipal{PrincipalClassification: msp.MSPPrincipal_IDENTITY, Principal: adminCertBytes}
// after: sign with the identity matching the pinned cert
signer, _ := msp.DeserializeIdentity(adminCertBytes); signature, _ := signer.Sign(msg)

Defensive patterns

Strategy: validation

Validate before calling

principalId, err := msp.DeserializeIdentity(principal.Principal)
if err != nil {
	return fmt.Errorf("principal is not a valid certificate: %w", err)
}
if !bytes.Equal(signerCertRaw, principal.(*msp.identity).Cert().Raw) {
	return fmt.Errorf("signer %x does not match principal pinned in policy", signerCertRaw)
}

Type guard

func isIdentityPrincipal(p *msp.MSPPrincipal, id msp.Identity) bool {
	if p.PrincipalClassification != msp.MSPPrincipal_IDENTITY {
		return false
	}
	return bytes.Equal(id.(*msp.identity).Cert().Raw, p.Principal)
}

Try / catch

err := policy.Evaluate(sd)
if err != nil && strings.Contains(err.Error(), "The identities do not match") {
	// wrong signer: re-sign with the identity whose cert the policy pins
}

Prevention

Pin identities in policies by extracting the cert from the same enrollment you will sign with
Never confuse TLS certs with enrollment/signing certs
Re-sign with the pinned identity or update the policy when certificates are rotated

When it happens

Trigger: Calling policy evaluation (e.g. policy.Manager Evaluate / satisfiesPrincipal) where principal.PrincipalClassification == MSPPrincipal_IDENTITY and the signer's cert does not equal the cert embedded in the principal, e.g. signing with a different admin cert than the one named in the policy.

Common situations: Signed proposals rejected because the client enrolled with a non-admin cert while the policy pins the admin identity; rotated certificates so the policy's embedded cert no longer equals the current signer; using the TLS cert instead of the enrollment/signing cert.

Related errors

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/e06773f5c34355f1. Report an issue: GitHub.