hyperledger/fabric · error

unmarshalling of the certificate failed

Error message

unmarshalling of the certificate failed

What it means

certFromX509Cert re-parses a certificate's raw DER bytes with encoding/asn1 into Fabric's internal certificate struct. This error means the DER bytes could not be unmarshalled into the expected ASN.1 certificate structure, so the certificate is malformed or uses an encoding Fabric's struct does not model. It is wrapped around the underlying asn1 error.

Source

Thrown at msp/cert.go:122

	// 2. Change the signature
	newCert.SignatureValue = asn1.BitString{Bytes: expectedSig, BitLength: len(expectedSig) * 8}
	newCert.Raw = nil

	// 3. marshal again newCert. Raw must be nil
	newRaw, err := asn1.Marshal(newCert)
	if err != nil {
		return nil, errors.Wrap(err, "marshalling of the certificate failed")
	}

	// 4. parse newRaw to get an x509 certificate
	return x509.ParseCertificate(newRaw)
}

func certFromX509Cert(cert *x509.Certificate) (certificate, error) {
	var newCert certificate
	_, err := asn1.Unmarshal(cert.Raw, &newCert)
	if err != nil {
		return certificate{}, errors.Wrap(err, "unmarshalling of the certificate failed")
	}
	return newCert, nil
}

// String returns a PEM representation of a certificate
func (c certificate) String() string {
	b, err := asn1.Marshal(c)
	if err != nil {
		return fmt.Sprintf("Failed marshaling cert: %v", err)
	}
	block := &pem.Block{
		Bytes: b,
		Type:  "CERTIFICATE",
	}
	b = pem.EncodeToMemory(block)
	return string(b)
}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Replace the malformed certificate file in the MSP directory with a valid PEM cert generated via openssl or cryptogen
2. Run 'openssl x509 -in cert.pem -text -noout' on each cert to find the one that fails to parse
3. Re-generate the MSP material with cryptogen or the Fabric CA instead of hand-editing DER bytes
4. Check whether an intermediate tool (e.g. an editor or base64 conversion) corrupted the file

Example fix

// before: hand-copied/truncated cert bytes loaded into MSP
cert, _ := x509.ParseCertificate(rawBytes)
newCert, err := certFromX509Cert(cert) // fails
// after: load a freshly generated, intact PEM cert
pemBytes, _ := os.ReadFile("cacerts/ca-cert.pem")
block, _ := pem.Decode(pemBytes)
x509Cert, _ := x509.ParseCertificate(block.Bytes)
newCert, err := certFromX509Cert(x509Cert)

func validateX509Cert(cert *x509.Certificate) error {
    if cert == nil || len(cert.Raw) == 0 {
        return fmt.Errorf("certificate has no raw DER content")
    }
    var probe certificate
    if _, err := asn1.Unmarshal(cert.Raw, &probe); err != nil {
        return fmt.Errorf("cert not decodable as fabric certificate: %w", err)
    }
    return nil
}

func isWellFormedCert(cert *x509.Certificate) bool {
    var probe certificate
    ok, err := asn1.Unmarshal(cert.Raw, &probe)
    return err == nil && ok != nil
}

if err != nil { var asnErr *asn1.StructuralError
    if errors.As(err, &asnErr) { log.Fatalf("malformed certificate (ASN.1): %v", err) }
    return fmt.Errorf("load cert: %w", err) }

When it happens

Trigger: Calling sanitizeECDSASignedCert, certToPEM, or any code path (e.g. MSP setup, identity validation) that hands a *x509.Certificate whose Raw bytes do not decode as a standard Certificate ASN.1 sequence into certFromX509Cert.

Common situations: Corrupted or truncated certificate files in an MSP directory; certificates re-encoded by intermediary tools; exotic or non-standard extensions; hand-crafted test certs; certificates pulled from a non-X.509 source.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed parsing certificate %s
• parseCertificate failed
• enrollment certificate is not a valid x509 certificate: %v
• public keys do not match
• failed to PEM decode identity bytes: %s

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/5096770113590631. Report an issue: GitHub.