{"record":{"id":"a623bfe630be1245","repo":"OpenNHP/opennhp","slug":"failed-to-download-hsk-cek-v","errorCode":null,"errorMessage":"failed to download hsk_cek: %v","messagePattern":"failed to download hsk_cek: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":341,"sourceCode":"\n\tif err := a.verifyHygonCertInfo(a.hrk, 0x03, 0, a.hrk[0x04:0x14]); err != nil {\n\t\treturn err\n\t}\n\n\t// verify hrk cert signature (self-signed)\n\thrkIdLen := int(binary.LittleEndian.Uint16(a.hrk[0xd4:0xd6]))\n\tif err := a.verifySm2SignatureWithId(\n\t\ta.hrk[0x44:0x64], a.hrk[0x8c:0xac],\n\t\ta.hrk[0x240:0x260], a.hrk[0x288:0x2a8],\n\t\ta.hrk[0xd6:0xd6+hrkIdLen], a.hrk[:0x240],\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tif _, ok := a.hskCek[chipId]; !ok {\n\t\tresp, err := http.Get(fmt.Sprintf(\"https://cert.hygon.cn/hsk_cek?snumber=%s\", chipId))\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download hsk_cek: %v\", err)\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn fmt.Errorf(\"unexpected status code when download hsk_cek: %d\", resp.StatusCode)\n\t\t}\n\n\t\thskCekData, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read hsk_cek data: %v\", err)\n\t\t}\n\n\t\ta.hskCek[chipId] = hskCekData\n\t}\n\n\thskData := a.hskCek[chipId][:0x340]\n\tcekData := a.hskCek[chipId][0x340:]\n","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L323-L359","documentation":"During CSV (Hygon) attestation, verifyCertChain downloads the HSK/CEK certificate blob from Hygon's public CA endpoint (https://cert.hygon.cn/hsk_cek?snumber=<chipId>) unless it is already cached in a.hskCek. This error wraps any transport-level failure of that http.Get call (DNS failure, refused connection, TLS error, timeout). It means the verifier could not reach Hygon's certificate server at all, not that it returned a bad response.","triggerScenarios":"Calling Attestation.Verify (which calls verifyCertChain) on CSV evidence whose chipId is not yet in the hskCek cache while the host running the verifier has no outbound internet access, DNS for cert.hygon.cn fails, the endpoint is down, or a firewall/proxy blocks the HTTPS request.","commonSituations":"Running the verifier in an air-gapped or firewalled datacenter; CI environments without egress to Chinese endpoints (cert.hygon.cn is hosted in China and may be slow/blocked elsewhere); transient Hygon CA outages; misconfigured corporate proxies.","solutions":["Ensure the verifier host has outbound HTTPS connectivity to cert.hygon.cn (test with curl 'https://cert.hygon.cn/hsk_cek?snumber=<chipId>').","Pre-populate the hskCek cache for the chipId so no network fetch is needed (a.hskCek is consulted before downloading).","Add retry logic with a timeout around the download, since the failure is often transient.","Configure HTTP(S)_PROXY or fix DNS if the environment requires a proxy or has resolution problems."],"exampleFix":"// before\nresp, err := http.Get(fmt.Sprintf(\"https://cert.hygon.cn/hsk_cek?snumber=%s\", chipId))\nif err != nil {\n    return fmt.Errorf(\"failed to download hsk_cek: %v\", err)\n}\n// after\nclient := &http.Client{Timeout: 15 * time.Second}\nvar resp *http.Response\nvar lastErr error\nfor i := 0; i < 3; i++ {\n    resp, lastErr = client.Get(fmt.Sprintf(\"https://cert.hygon.cn/hsk_cek?snumber=%s\", chipId))\n    if lastErr == nil {\n        break\n    }\n    time.Sleep(time.Duration(i+1) * time.Second)\n}\nif lastErr != nil {\n    return fmt.Errorf(\"failed to download hsk_cek: %v\", lastErr)\n}","handlingStrategy":"retry","validationCode":"conn, err := net.DialTimeout(\"tcp\", \"cert.hygon.cn:443\", 5*time.Second)\nif err != nil {\n    return fmt.Errorf(\"hygon CA unreachable: %w\", err)\n}\nconn.Close()","typeGuard":null,"tryCatchPattern":"err := attestation.Verify(ctx, evidence)\nvar netErr net.Error\nif err != nil {\n    if errors.As(err, &netErr) || strings.Contains(err.Error(), \"failed to download hsk_cek\") {\n        // transient network problem: retry with backoff or fall back to cached CEK\n    }\n}","preventionTips":["Pre-cache hsk_cek blobs for all chipIds you attest so Verify works offline.","Monitor egress connectivity to cert.hygon.cn from verifier hosts.","Set explicit HTTP client timeouts instead of relying on the default no-timeout http.Get.","Run attestation with retries when the verifier sits behind proxies or VPNs."],"tags":["network","http","attestation","certificate-download"],"backgroundTag":"http-request-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}