Issue: Hyperledger Fabric Peer Node Fails to Start with CA Certificate in MSP Configuration

[Windol]

I'm trying to deploy a Hyperledger Fabric network using certificates generated by a Certificate Authority (CA) with an intermediate certificate. When starting a Peer node with the MSP configuration file (config.yaml) containing:

PeerOUIdentifier:
  Certificate: cacerts/ca-cert.pem
  OrganizationUnitIdentifier: Peer

The peer node fails to start due to server certificate validation errors.

However, when I use the intermediate certificate configuration instead:

PeerOUIdentifier:
  Certificate: intermediatecerts/intermediate-cert.pem
  OrganizationalUnitIdentifier: Peer

The peer node starts successfully.

Question: Why does the peer node fail when using the root CA certificate but work correctly with the intermediate certificate in the MSP configuration? Is this expected behavior or a configuration issue?

---

Additional context that might be helpful:

• Hyperledger Fabric version: 3.1.1
• CA type: external CA
• Certificate chain structure: CA -> Intermediate -> Peer
• Error message from the peer logs:

panic: Failed putting our own identity into the identity mapper: failed classifying identity: Unable to extract msp.Identity from peer Identity: could not validate identity's OUs: certifiersIdentifier does not match:

[akash-R-A-J]

This is expected behavior, not a bug.

Explanation

The PeerOUIdentifier.Certificate field in config.yaml must reference the CA that directly signed the peer certificates — not the root of the trust chain.

In your certificate hierarchy:

Root CA ──signs──> Intermediate CA ──signs──> Peer Certificate

The peer certificate was signed by the Intermediate CA, so Fabric's NodeOU classification requires:

PeerOUIdentifier:
  Certificate: intermediatecerts/intermediate-cert.pem
  OrganizationalUnitIdentifier: peer

Why Root CA Fails

When you specify cacerts/ca-cert.pem, Fabric checks:

1. Does the peer certificate have OU=peer? ✅
2. Was this certificate issued by the CA at cacerts/ca-cert.pem? ❌

Since the peer cert was issued by the Intermediate CA (not the Root CA), validation fails with:

certifiersIdentifier does not match

The Fix

For all NodeOU identifiers, point to the certificate that directly issues identity certificates:

NodeOUs:
  Enable: true
  ClientOUIdentifier:
    Certificate: intermediatecerts/intermediate-cert.pem
    OrganizationalUnitIdentifier: client
  PeerOUIdentifier:
    Certificate: intermediatecerts/intermediate-cert.pem
    OrganizationalUnitIdentifier: peer
  AdminOUIdentifier:
    Certificate: intermediatecerts/intermediate-cert.pem
    OrganizationalUnitIdentifier: admin
  OrdererOUIdentifier:
    Certificate: intermediatecerts/intermediate-cert.pem
    OrganizationalUnitIdentifier: orderer

Note: The cacerts/ folder should still contain the Root CA for trust chain validation, but NodeOU classification uses the direct issuer.

This behavior is consistent with how X.509 certificate issuance works — the issuer field in the peer certificate matches the intermediate CA's subject, not the root CA's.