{"record":{"id":"a64c45abbf2555a2","repo":"OpenNHP/opennhp","slug":"unexpected-status-code-when-download-hsk-cek-d","errorCode":null,"errorMessage":"unexpected status code when download hsk_cek: %d","messagePattern":"unexpected status code when download hsk_cek: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":346,"sourceCode":"\t// verify hrk cert signature (self-signed)\n\thrkIdLen := int(binary.LittleEndian.Uint16(a.hrk[0xd4:0xd6]))\n\tif err := a.verifySm2SignatureWithId(\n\t\ta.hrk[0x44:0x64], a.hrk[0x8c:0xac],\n\t\ta.hrk[0x240:0x260], a.hrk[0x288:0x2a8],\n\t\ta.hrk[0xd6:0xd6+hrkIdLen], a.hrk[:0x240],\n\t); err != nil {\n\t\treturn err\n\t}\n\n\tif _, ok := a.hskCek[chipId]; !ok {\n\t\tresp, err := http.Get(fmt.Sprintf(\"https://cert.hygon.cn/hsk_cek?snumber=%s\", chipId))\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download hsk_cek: %v\", err)\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn fmt.Errorf(\"unexpected status code when download hsk_cek: %d\", resp.StatusCode)\n\t\t}\n\n\t\thskCekData, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read hsk_cek data: %v\", err)\n\t\t}\n\n\t\ta.hskCek[chipId] = hskCekData\n\t}\n\n\thskData := a.hskCek[chipId][:0x340]\n\tcekData := a.hskCek[chipId][0x340:]\n\n\t// verify hsk cert info\n\tif err := a.verifyHygonCertInfo(hskData, 0x03, 0x13, a.hrk[0x04:0x14]); err != nil {\n\t\treturn err\n\t}\n","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L328-L364","documentation":"After the HTTP GET to Hygon's CA succeeds at the transport level, verifyCertChain checks the response status. Any status other than 200 (e.g. 404 for an unknown chip serial number, 403 rate-limit/forbidden, 5xx server error) produces this error with the numeric status code. The response body is not inspected, so the reason is whatever the server encoded in the status code.","triggerScenarios":"Calling Verify on CSV evidence with a chipId that Hygon's CA does not recognize (404), when cert.hygon.cn returns 403/429 (blocking or rate limiting), or 5xx during a Hygon-side outage.","commonSituations":"Forged, corrupted, or non-Hygon chipId in the attestation evidence; fetching a CEK for a very new Hygon CPU generation not yet published on the CA; Hygon server rejecting requests from foreign IPs; hitting the endpoint too frequently in a test loop.","solutions":["Log/read the response body for the failing status to learn the server's reason, then correct the chipId or request.","Verify the chipId in the CSV evidence is a genuine Hygon serial number; a 404 usually means an invalid/unknown snumber.","Check for rate limiting or geo-blocking (403/429) and retry from an allowed network or with backoff.","Retry later on 5xx; pre-seed the hskCek cache with the CEK blob for known chipIds to avoid live fetches."],"exampleFix":"// before\nif resp.StatusCode != http.StatusOK {\n    return fmt.Errorf(\"unexpected status code when download hsk_cek: %d\", resp.StatusCode)\n}\n// after\nif resp.StatusCode != http.StatusOK {\n    body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))\n    return fmt.Errorf(\"unexpected status code when download hsk_cek: %d, body: %s\", resp.StatusCode, string(body))\n}","handlingStrategy":"fallback","validationCode":"resp, err := http.Head(\"https://cert.hygon.cn/hsk_cek?snumber=\" + chipId)\nif err == nil && resp.StatusCode != http.StatusOK {\n    return fmt.Errorf(\"hygon CA will reject chipId %s: status %d\", chipId, resp.StatusCode)\n}","typeGuard":null,"tryCatchPattern":"if err := attestation.Verify(ctx, evidence); err != nil {\n    var httpErr *HTTPStatusError\n    if strings.Contains(err.Error(), \"unexpected status code when download hsk_cek\") {\n        // distinguish 404 (bad chipId) from 5xx (retry later) via the embedded code\n    }\n}","preventionTips":["Validate that chipIds come from genuine Hygon CSV evidence before attestation.","Rate-limit lookups against the Hygon CA to avoid 403/429 blocks.","Cache successful CEK downloads keyed by chipId to minimize live requests.","Keep CEK blobs updated when adding new Hygon CPU generations."],"tags":["http","http-status","attestation","certificate-download"],"backgroundTag":"http-error-response","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}