How to Create a Snapshot in Hyperledger Fabric — Unable to Find Valid Certificate

[hamidrgholipour]

Hi everyone,

I'm trying to create a snapshot using the following command:

peer snapshot submitrequest -c test-channel -b 15
--peerAddress peer01.test:7051
--tlsRootCertFile

However, I'm facing TLS handshake and authorization issues depending on which certificate I use.
🔧 Deployment Context:

Fabric network is deployed using the Hyperledger Fabric Operator (on Kubernetes).
I'm trying to run the command from a peer inside the cluster
I’ve checked all .crt and .pem files available under the volume mounts for admin users and CA directories.

❌ Issues I'm Facing:

When using the CA certificate :

failed verifying that the signed data identity satisfies local MSP principal with policy [Admins]:
The identity is not an admin under this MSP [testnMSP]

I assume this is because the certificate lacks the required OU=ADMIN.

When using an Admin user's cert :

Client TLS handshake failed with error: x509: certificate signed by unknown authority

    I checked and confirmed that the admin certificate has OU=ADMIN, and that it verifies correctly with the issuing CA.

🔍 What I've Tried:

Verified admin cert with OpenSSL: openssl verify -CAfile <ca.pem> <admin-cert.pem> ✅

Checked peer’s TLS cert with:
openssl s_client -connect peer01.test:7051 -showcerts
But I couldn’t identify which CA is trusted by the peer.

Tried all combinations of:

    --tlsRootCertFile as peer's CA, admin cert, and organization CA.

    Running the command from inside the cluster and outside.

💬 My Question:

How can I correctly find and use the certificate required for:

--tlsRootCertFile (peer TLS trust)

The admin user identity (to satisfy the Admin policy)

Any guidance on how to:

Identify the correct trusted CA for the peer's TLS

Use an admin certificate that satisfies the MSP Admin policy and works for TLS

would be greatly appreciated!

Thanks in advance!
Let me know if you need any logs or cert details.

[Ultronen]

These are two separate trust checks, so the two errors point to different inputs:

• --tlsRootCertFile must contain the CA chain that signed the peer's TLS server certificate at peer01.test:7051. It is not the admin enrollment certificate. The Fabric TLS guide says the equivalent CLI setting is CORE_PEER_TLS_ROOTCERT_FILE. Verify the endpoint with openssl s_client -connect peer01.test:7051 -servername peer01.test -showcerts -CAfile <peer-tls-ca-chain.pem> -verify_return_error; also check that the hostname matches the certificate SAN.
• The snapshot request is signed with the admin enrollment identity selected by the peer CLI's local MSP configuration: CORE_PEER_LOCALMSPID=<peer-org-msp-id> and CORE_PEER_MSPCONFIGPATH=<admin-msp-directory> (with signcerts, keystore, and the appropriate MSP config). That identity must be recognized as an admin by the peer's MSP policy. OU=ADMIN alone does not prove this: the cert must be from the enrollment CA trusted by that MSP and match its Node OU/admin configuration. Verify that the MSP ID in the error (testnMSP) is the one intended for this peer and that the admin MSP directory belongs to it.

If the peer has mutual TLS enabled, you additionally need a TLS client certificate/key trusted by the peer's TLS client CA, via CORE_PEER_TLS_CLIENTAUTHREQUIRED=true, CORE_PEER_TLS_CLIENTCERT_FILE, and CORE_PEER_TLS_CLIENTKEY_FILE. That TLS client certificate is separate from the admin enrollment signing identity.

So I would first make the s_client/CA-chain check pass, then run peer snapshot listpending with the admin MSP settings, and only then retry submitrequest. A successful TLS handshake followed by identity is not an admin narrows the remaining problem to the signing MSP identity/policy. Fabric's snapshot command reference specifies the peer TLS root flag; its TLS guide describes the separate server-root and mutual-TLS client settings.