{"record":{"id":"b14a2295c7dfd9aa","repo":"OpenNHP/opennhp","slug":"unexpected-status-code-when-download-hrk-d","errorCode":null,"errorMessage":"unexpected status code when download HRK: %d","messagePattern":"unexpected status code when download HRK: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"nhp/core/verifier/csv/csv.go","lineNumber":302,"sourceCode":"\n\tif VerifySignature(pubKey, msgAllDigest, rBig, sBig) {\n\t\treturn nil\n\t} else {\n\t\treturn fmt.Errorf(\"failed to verify signature\")\n\t}\n}\n\nfunc (a *Attestation) verifyCertChain(chipId string) error {\n\t// Download HRK from Hygon's certificate server\n\tif a.hrk == nil {\n\t\tresp, err := http.Get(\"https://cert.hygon.cn/hrk\")\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to download HRK: %v\", err)\n\t\t}\n\t\tdefer resp.Body.Close()\n\n\t\tif resp.StatusCode != http.StatusOK {\n\t\t\treturn fmt.Errorf(\"unexpected status code when download HRK: %d\", resp.StatusCode)\n\t\t}\n\n\t\t// Read the response body (HRK content)\n\t\thrkData, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to read HRK data: %v\", err)\n\t\t}\n\n\t\ta.hrk = hrkData\n\t}\n\n\tdigest, err := Sm3Digest(a.hrk)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\texpectedDigest, _ := hex.DecodeString(\"f5a46663059fdb4cdd06d097ed21782142923bb3430b3b938f23d54292094e3a\")\n\tif !bytes.Equal(digest, expectedDigest) {","sourceCodeStart":284,"sourceCodeEnd":320,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/nhp/core/verifier/csv/csv.go#L284-L320","documentation":"verifyCertChain checks that the HRK download from https://cert.hygon.cn/hrk returned HTTP 200; any other status produces this error with the numeric status code. The library received a valid HTTP response but the server refused or failed the request, so the body is not treated as an HRK.","triggerScenarios":"First verifyCertChain call when a.hrk is nil and the response status from https://cert.hygon.cn/hrk is not 200 OK — e.g. 403 (geo/IP blocked), 404, 429 (rate limited), 5xx (server outage), or 302 responses that http.Get does not follow to a 200.","commonSituations":"Hygon cert server outage or maintenance; rate limiting after many attestations (HRK is not cached across processes); region-based blocking outside China; a captive portal or proxy returning 401/403 HTML.","solutions":["Check the reported status code and retry after an interval if it is 429/5xx.","Cache the HRK persistently (disk) after first successful download so repeated verifications do not hit the server.","Inspect the response from curl -i https://cert.hygon.cn/hrk to see whether a proxy or block page is intercepting.","Pin the HRK blob locally (validated against the known digest f5a46663...) to remove runtime dependence on the remote server.","If a redirect is being rejected (some 3xx), follow redirects explicitly or use a client configured to do so."],"exampleFix":"// before\nif resp.StatusCode != http.StatusOK {\n\treturn fmt.Errorf(\"unexpected status code when download HRK: %d\", resp.StatusCode)\n}\n// after: retry on transient statuses, fail on permanent ones\nif resp.StatusCode == http.StatusTooManyRequests || resp.StatusCode >= 500 {\n\ttime.Sleep(backoff)\n\t// retry the request\n} else if resp.StatusCode != http.StatusOK {\n\treturn fmt.Errorf(\"unexpected status code when download HRK: %d\", resp.StatusCode)\n}","handlingStrategy":"retry","validationCode":"// preflight the endpoint status\nresp, err := http.Get(\"https://cert.hygon.cn/hrk\")\nif err == nil && resp.StatusCode != http.StatusOK {\n\tlog.Printf(\"HRK endpoint unhealthy: %d\", resp.StatusCode)\n}","typeGuard":null,"tryCatchPattern":"if err := att.Verify(chipId); err != nil {\n\tvar status int\n\tif n, _ := fmt.Sscanf(err.Error(), \"unexpected status code when download HRK: %d\", &status); n == 1 && (status == 429 || status >= 500) {\n\t\ttime.Sleep(5 * time.Second)\n\t\treturn att.Verify(chipId) // bounded retries recommended\n\t}\n\treturn err\n}","preventionTips":["Cache the HRK on disk after first successful fetch to avoid hammering the endpoint.","Monitor the Hygon cert server status from your infrastructure.","Fall back to a pinned HRK validated against its known digest.","Watch for proxy block pages that return non-200."],"tags":["http","network","hrk-download","http-status"],"backgroundTag":"http-non-200-response","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}