OpenNHP/opennhp · error

certifying id mismatch: got

Error message

certifying id mismatch: got %x, want %x

What it means

Raised in verifyHygonCertInfo while checking a Hygon CSV attestation certificate: the certifying-id bytes at offset 0x14-0x24 of the hrk block do not equal the expected keyId. A mismatch means the certification blob was produced under a different certifying identity (wrong vendor key, mismatched platform, or corrupted blob), so the cert chain is rejected.

Solutions

1. Confirm the attestation evidence comes from the platform/firmware generation expected by the verifier
2. Update the verifier's trusted keyId/certifying-id table for the Hygon firmware in use
3. Check evidence transport (base64/zlib) for corruption if platforms genuinely match

When it happens

Trigger: Thrown at nhp/core/verifier/csv/csv.go:430 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/9045694dbcff9f5b. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/csv/csv.go:430

}

func (a *Attestation) verifyHygonCertInfo(hrk []byte, curveId, keyUsage int, keyId []byte) error {
	hygonKeyUsage := hrk[0x24:0x28]

	hygonKeyUsageInt := int(binary.LittleEndian.Uint32(hygonKeyUsage))
	if hygonKeyUsageInt != keyUsage {
		return fmt.Errorf("key usage mismatch: got %d, want %d", keyUsage, keyUsage)
	}

	hygonCurveId := hrk[0x40:0x44]
	hygonCurveIdInt := int(binary.LittleEndian.Uint32(hygonCurveId))
	if hygonCurveIdInt != curveId {
		return fmt.Errorf("curve id mismatch: got %d, want %d", curveId, curveId)
	}

	hygonCertifyingId := hrk[0x14:0x24]
	if !bytes.Equal(hygonCertifyingId, keyId) {
		return fmt.Errorf("certifying id mismatch: got %x, want %x", hygonCertifyingId, keyId)
	}

	return nil
}

func (a *Attestation) verifyCSVCertInfo(csvCert []byte, sigUsage int, sigAlgo int, keyUsage int, keyId []byte) error {
	csvKeyUsage := csvCert[0x08:0x0C]
	csvKeyUsageInt := int(binary.LittleEndian.Uint32(csvKeyUsage))
	if csvKeyUsageInt != keyUsage {
		return fmt.Errorf("key usage mismatch: got %d, want %d", csvKeyUsageInt, sigUsage)
	}

	csvSigUsage := csvCert[0x414:0x418]
	csvSigUsageInt := int(binary.LittleEndian.Uint32(csvSigUsage))
	if csvSigUsageInt != sigUsage {
		return fmt.Errorf("sig usage mismatch: got %d, want %d", csvSigUsageInt, sigAlgo)
	}

View on GitHub (pinned to 6e04ca5ff0)