OpenNHP/opennhp · error

unexpected status code when download hsk_cek

Error message

unexpected status code when download hsk_cek: %d

What it means

After the HTTP GET to Hygon's CA succeeds at the transport level, verifyCertChain checks the response status. Any status other than 200 (e.g. 404 for an unknown chip serial number, 403 rate-limit/forbidden, 5xx server error) produces this error with the numeric status code. The response body is not inspected, so the reason is whatever the server encoded in the status code.

Solutions

1. Log/read the response body for the failing status to learn the server's reason, then correct the chipId or request.
2. Verify the chipId in the CSV evidence is a genuine Hygon serial number; a 404 usually means an invalid/unknown snumber.
3. Check for rate limiting or geo-blocking (403/429) and retry from an allowed network or with backoff.
4. Retry later on 5xx; pre-seed the hskCek cache with the CEK blob for known chipIds to avoid live fetches.

Example fix

// before
if resp.StatusCode != http.StatusOK {
    return fmt.Errorf("unexpected status code when download hsk_cek: %d", resp.StatusCode)
}
// after
if resp.StatusCode != http.StatusOK {
    body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
    return fmt.Errorf("unexpected status code when download hsk_cek: %d, body: %s", resp.StatusCode, string(body))
}

resp, err := http.Head("https://cert.hygon.cn/hsk_cek?snumber=" + chipId)
if err == nil && resp.StatusCode != http.StatusOK {
    return fmt.Errorf("hygon CA will reject chipId %s: status %d", chipId, resp.StatusCode)
}

if err := attestation.Verify(ctx, evidence); err != nil {
    var httpErr *HTTPStatusError
    if strings.Contains(err.Error(), "unexpected status code when download hsk_cek") {
        // distinguish 404 (bad chipId) from 5xx (retry later) via the embedded code
    }
}

When it happens

Trigger: Calling Verify on CSV evidence with a chipId that Hygon's CA does not recognize (404), when cert.hygon.cn returns 403/429 (blocking or rate limiting), or 5xx during a Hygon-side outage.

Common situations: Forged, corrupted, or non-Hygon chipId in the attestation evidence; fetching a CEK for a very new Hygon CPU generation not yet published on the CA; Hygon server rejecting requests from foreign IPs; hitting the endpoint too frequently in a test loop.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• failed to download hsk_cek
• unexpected status code
• failed to download HRK
• unexpected status code when download HRK
• http request failed

AI-assisted analysis of OpenNHP/opennhp@6e04ca5ff0 (2026-09-07). Data as JSON: /api/errors/a64c45abbf2555a2. Report an issue: GitHub.

Appendix: source

Thrown at nhp/core/verifier/csv/csv.go:346

	// verify hrk cert signature (self-signed)
	hrkIdLen := int(binary.LittleEndian.Uint16(a.hrk[0xd4:0xd6]))
	if err := a.verifySm2SignatureWithId(
		a.hrk[0x44:0x64], a.hrk[0x8c:0xac],
		a.hrk[0x240:0x260], a.hrk[0x288:0x2a8],
		a.hrk[0xd6:0xd6+hrkIdLen], a.hrk[:0x240],
	); err != nil {
		return err
	}

	if _, ok := a.hskCek[chipId]; !ok {
		resp, err := http.Get(fmt.Sprintf("https://cert.hygon.cn/hsk_cek?snumber=%s", chipId))
		if err != nil {
			return fmt.Errorf("failed to download hsk_cek: %v", err)
		}
		defer resp.Body.Close()

		if resp.StatusCode != http.StatusOK {
			return fmt.Errorf("unexpected status code when download hsk_cek: %d", resp.StatusCode)
		}

		hskCekData, err := io.ReadAll(resp.Body)
		if err != nil {
			return fmt.Errorf("failed to read hsk_cek data: %v", err)
		}

		a.hskCek[chipId] = hskCekData
	}

	hskData := a.hskCek[chipId][:0x340]
	cekData := a.hskCek[chipId][0x340:]

	// verify hsk cert info
	if err := a.verifyHygonCertInfo(hskData, 0x03, 0x13, a.hrk[0x04:0x14]); err != nil {
		return err
	}

View on GitHub (pinned to 6e04ca5ff0)