Error to update orderermsp in Hyperledger fabric

Question

I am try to migrate kafka to raft and try to update channel configuration in which EnableNodeOUs is true when I sign the update file with orderermsp it give error

result err: sub-policies were satisfied, but this policy requires 1 of the 'Admins' sub-policies to be satisfied

this are the command which i follow

# change work directories
mkdir maintenance_on_$CHANNEL_NAME && cd maintenance_on_$CHANNEL_NAME

# fetch current channel config
peer channel fetch config config_block.pb -o orderer0.dxb.com:7050 -c avanzachannel --tls --cafile $ORDERER_CA

# decode fetched channel config
configtxlator proto_decode --input config_block.pb --type common.Block --output config_block.json
jq .data.data[0].payload.data.config config_block.json > config.json

# save old config, to calculate delta in the future
cp config.json config_mod.json

cat config.json | grep name


# set maintenance mode in configs
sed -i 's/NORMAL/MAINTENANCE/g' config_mod.json

# encode old config to protopuf
configtxlator proto_encode --input config.json --type common.Config --output config.pb

# encode new config to protopuf
configtxlator proto_encode --input config_mod.json --type common.Config --output modified_config.pb

# compute delta between configs
configtxlator compute_update --channel_id $CHANNEL_NAME --original config.pb --updated modified_config.pb --output config_update.pb

# decode delta config
configtxlator proto_decode --input config_update.pb --type common.ConfigUpdate | jq . > config_update.json

# wrap delta config with a header
echo '{"payload":{"header":{"channel_header":{"channel_id":"avanzachannel", "type":2}},"data":{"config_update":'$(cat config_update.json)'}}}' | jq . > config_update_envelope.json

# encode wrapped config to protopuf
configtxlator proto_encode --input config_update_envelope.json --type common.Envelope --output config_update_in_envelope.pb

# sign channel update config


export CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/crypto/ordererOrganizations/dxb.com/orderers/orderer0.dxb.com/tls/ca.crt
export CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/dxb.com/users/Admin@dxb.com/msp
export CORE_PEER_LOCALMSPID=OrdererMSP


peer channel signconfigtx -f config_update_in_envelope.pb


# # export all needed env vars
# export CORE_PEER_LOCALMSPID="OrdererMSP"
# export CORE_PEER_TLS_ROOTCERT_FILE=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/crypto/ordererOrganizations/dxb.com/orderers/orderer.dxb.com/tls/ca.crt
# export CORE_PEER_MSPCONFIGPATH=/opt/gopath/src/github.com/hyperledger/fabric/peer/crypto/ordererOrganizations/dxb.com/users/Admin@dxb.com/msp/
# export CORE_PEER_ADDRESS=peer0.org1.dxb.com:7051

# submit new channel config
peer channel update -f config_update_in_envelope.pb -c $CHANNEL_NAME -o orderer0.dxb.com:7050 --tls --cafile $ORDERER_CA

Answer 1

I think the problem is the same as this link.

The problem is that your orderer admin cert doesn't have a correct 'OU'.

You can follow the answer and try all steps again.