How to Create a Snapshot in Hyperledger Fabric — Unable to Find Valid Certificate

[hamidrgholipour]

Hi everyone,

I'm trying to create a snapshot using the following command:

peer snapshot submitrequest -c test-channel -b 15
--peerAddress peer01.test:7051
--tlsRootCertFile

However, I'm facing TLS handshake and authorization issues depending on which certificate I use.
🔧 Deployment Context:

Fabric network is deployed using the Hyperledger Fabric Operator (on Kubernetes).
I'm trying to run the command from a peer inside the cluster
I’ve checked all .crt and .pem files available under the volume mounts for admin users and CA directories.

❌ Issues I'm Facing:

When using the CA certificate :

failed verifying that the signed data identity satisfies local MSP principal with policy [Admins]:
The identity is not an admin under this MSP [testnMSP]

I assume this is because the certificate lacks the required OU=ADMIN.

When using an Admin user's cert :

Client TLS handshake failed with error: x509: certificate signed by unknown authority

    I checked and confirmed that the admin certificate has OU=ADMIN, and that it verifies correctly with the issuing CA.

🔍 What I've Tried:

Verified admin cert with OpenSSL: openssl verify -CAfile <ca.pem> <admin-cert.pem> ✅

Checked peer’s TLS cert with:
openssl s_client -connect peer01.test:7051 -showcerts
But I couldn’t identify which CA is trusted by the peer.

Tried all combinations of:

    --tlsRootCertFile as peer's CA, admin cert, and organization CA.

    Running the command from inside the cluster and outside.

💬 My Question:

How can I correctly find and use the certificate required for:

--tlsRootCertFile (peer TLS trust)

The admin user identity (to satisfy the Admin policy)

Any guidance on how to:

Identify the correct trusted CA for the peer's TLS

Use an admin certificate that satisfies the MSP Admin policy and works for TLS

would be greatly appreciated!

Thanks in advance!
Let me know if you need any logs or cert details.