The system is working now. documenting just in case if any1 in future facing the same errors which I faced.

1)while doing a system channel update if you face the below error, check your admin cert in the map (which should be the admin sign cert from the org admin directory)

Error: got unexpected status: BAD_REQUEST -- error applying config update to existing channel 'syschannel': initializing channelconfig failed: could not create channel Consortiums sub-group config: setting up the MSP manager failed: admin 0 is invalid [The identity does not contain OU [CLIENT], MSP: [usisp],The identity does not contain OU [ADMIN], MSP: [usisp]]

2)on adding a consortium, if the error is indicating that the channel does not have capabilities (while deploying chaincode), check the configtx.yaml of the new org in the new consortium. It should include the below part and linked in the consortium definition

Thanks Satheesh, it worked. I had to specify the relative path for the tls cert, I was specifying the absolute path.

now I am trying to edit system channel and getting the following error. any idea about this?

Error: got unexpected status: BAD_REQUEST -- error applying config update to existing channel 'syschannel': initializing channelconfig failed: could not create channel Consortiums sub-group config: setting up the MSP manager failed: admin 0 is invalid [The identity does not contain OU [CLIENT], MSP: [usisp],The identity does not contain OU [ADMIN], MSP: [usisp]]

the steps I followed to edit the configuration is as follows

1) from new configtx.yaml I printed it to json format
configtxgen -printOrg usisp > ./usisp.json
2)convert sys channel config from pb to json and trim it

configtxlator proto_decode --input syschannel.pb --type common.Block | jq .data.data[0].payload.data.config > sys_config.json

3)append new consortium definition

jq -s ‘.[0] * {“channel_group”:{“groups”:{“Consortiums”:{“groups”: {“CEFI”: {“groups”: {“usisp”:.[1]}, “mod_policy”: “/Channel/Orderer/Admins”, “policies”: {}, “values”: {“ChannelCreationPolicy”: {“mod_policy”: “/Channel/Orderer/Admins”,”value”: {“type”: 3,”value”: {“rule”: “ANY”,”sub_policy”: “Admins”}},”version”: “0”}},”version”: “0”}}}}}}’ ./sys_config.json ./usisp.json > modified_config.json

4)convert original and new config to protobuf format
configtxlator proto_encode --input ./sys_config.json --type common.Config --output ./sys_config.pb
configtxlator proto_encode --input ./modified_config.json --type common.Config --output ./modified_config.pb

5)create protobuf with difference between the two

configtxlator compute_update --channel_id syschannel --original ./sys_config.pb --updated ./modified_config.pb --output ./usisp_update.pb

6)add header and tags
configtxlator proto_decode --input ./usisp_update.pb --type common.ConfigUpdate | jq . > ./usisp_update.json

echo ‘{“payload”:{“header”:{“channel_header”:{“channel_id”:”syschannel”, “type”:2}},”data”:{“config_update”:’$(cat ./usisp_update.json)’}}}’ | jq . > ./usisp_update_in_envelope.json

7)convert it back to pb format
configtxlator proto_encode --input ./usisp_update_in_envelope.json --type common.Envelope --output ./usisp_update_in_envelope.pb

8) and submit the update
peer channel update -f ./usisp_update_in_envelope.pb -c syschannel -o orderer0-service:7050 --tls --cafile   /etc/hyperledger/fabric/tls/server.crt

2022-06-26 10:49:33.889 UTC [channelCmd] InitCmdFactory -> INFO 001 Endorser and orderer connections initialized Error: got unexpected status: BAD_REQUEST -- error applying config update to existing channel 'syschannel': initializing channelconfig failed: could not create channel Consortiums sub-group config: setting up the MSP manager failed: admin 0 is invalid [The identity does not contain OU [CLIENT], MSP: [usisp],The identity does not contain OU [ADMIN], MSP: [usisp]]


I am attaching configtx for new org and cert generation script.

thanks

thanks for the reply Satheesh.
I tried the suggestion. the orderer name is just orderer0 so instead of orderer.example.com, I have used just orderer0. (this is correct right?). the error still persists

I would like to mention that this setup is spread between 2 clusters, I am exposing services between clusters to interconnect using skupper. 

the current running blockchain is on azure central India cluster and the new cluster where a new consortium of one org to be setup in US-east.

I also tried fetching the system config block from the new cluster with appropriate env variables and certs(shown below). 

Hey guys,