{"record":{"id":"dcc98ed163a9f043","repo":"rustfs/rustfs","slug":"challenge-expired","errorCode":"CHALLENGE_EXPIRED","errorMessage":"the challenge has expired at the evaluation time","messagePattern":"the challenge has expired at the evaluation time","errorType":"exception","errorClass":"EnrollmentError","httpStatus":null,"severity":"error","filePath":"rustfs/src/connect/offline/enrollment.rs","lineNumber":187,"sourceCode":"    #[error(\"protocolVersion is missing, malformed, or names an unsupported major version\")]\n    UnsupportedProtocol,\n\n    #[error(\"formatVersion is not a supported offline enrollment format\")]\n    UnsupportedFormat,\n\n    #[error(\"the signature is not 64 octets of fixed-width r||s in unpadded base64url\")]\n    SignatureMalformed,\n\n    #[error(\"the signature is not in its canonical low-S form\")]\n    SignatureNotCanonical,\n\n    #[error(\"the signature does not verify over the received octets\")]\n    SignatureInvalid,\n\n    #[error(\"the trust chain is not issued by a root pinned in this build\")]\n    EnrollmentRootUnknown,\n\n    #[error(\"a trust link is invalid, misordered, or outside its validity at the challenge issuedAt\")]\n    TrustChainInvalid,\n\n    #[error(\"connectKeyId is not the subject of the last trust link\")]\n    ConnectKeyUnchained,\n\n    #[error(\"no issued challenge matches this challengeId\")]\n    ChallengeUnknown,\n\n    #[error(\"the challenge is not yet valid at the evaluation time\")]\n    ChallengeNotYetValid,\n\n    #[error(\"the challenge has expired at the evaluation time\")]\n    ChallengeExpired,\n\n    #[error(\"the response nonce or challengeProof is not the one issued for this challenge\")]\n    ChallengeProofInvalid,\n\n    #[error(\"the response does not prove possession of the device key it presents\")]","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/rustfs/rustfs/blob/5dca076efed96e7b842de07c4c2111035ae7c7a2/rustfs/src/connect/offline/enrollment.rs#L169-L205","documentation":"During offline enrollment evaluation, the challenge's expiry time has already passed relative to the evaluation clock, so the response arrives too late. Enrollment challenges are deliberately short-lived to bound replay risk; a late response must be rejected and a fresh challenge issued, which also covers significant clock skew between issuer and evaluator.","triggerScenarios":"Thrown at rustfs/src/connect/offline/enrollment.rs:183 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Request a new challenge and produce a fresh enrollment response","Complete enrollment within the challenge validity window","Check device clock if challenges seem to expire immediately"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5dca076efed96e7b842de07c4c2111035ae7c7a2","analyzedAt":"2026-08-23T16:57:04.676Z","contentChangedAt":"2026-08-23T16:57:04.676Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}