rustfs/rustfs · error · EnrollmentError

CHALLENGE_EXPIRED

CHALLENGE_EXPIRED

Error message

the challenge has expired at the evaluation time

What it means

During offline enrollment evaluation, the challenge's expiry time has already passed relative to the evaluation clock, so the response arrives too late. Enrollment challenges are deliberately short-lived to bound replay risk; a late response must be rejected and a fresh challenge issued, which also covers significant clock skew between issuer and evaluator.

Source

Thrown at rustfs/src/connect/offline/enrollment.rs:187

    #[error("protocolVersion is missing, malformed, or names an unsupported major version")]
    UnsupportedProtocol,

    #[error("formatVersion is not a supported offline enrollment format")]
    UnsupportedFormat,

    #[error("the signature is not 64 octets of fixed-width r||s in unpadded base64url")]
    SignatureMalformed,

    #[error("the signature is not in its canonical low-S form")]
    SignatureNotCanonical,

    #[error("the signature does not verify over the received octets")]
    SignatureInvalid,

    #[error("the trust chain is not issued by a root pinned in this build")]
    EnrollmentRootUnknown,

    #[error("a trust link is invalid, misordered, or outside its validity at the challenge issuedAt")]
    TrustChainInvalid,

    #[error("connectKeyId is not the subject of the last trust link")]
    ConnectKeyUnchained,

    #[error("no issued challenge matches this challengeId")]
    ChallengeUnknown,

    #[error("the challenge is not yet valid at the evaluation time")]
    ChallengeNotYetValid,

    #[error("the challenge has expired at the evaluation time")]
    ChallengeExpired,

    #[error("the response nonce or challengeProof is not the one issued for this challenge")]
    ChallengeProofInvalid,

    #[error("the response does not prove possession of the device key it presents")]

View on GitHub (pinned to 5dca076efe)

Solutions

1. Request a new challenge and produce a fresh enrollment response
2. Complete enrollment within the challenge validity window
3. Check device clock if challenges seem to expire immediately

When it happens

Trigger: Thrown at rustfs/src/connect/offline/enrollment.rs:183 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of rustfs/rustfs@5dca076efe (2026-08-23). Data as JSON: /api/errors/dcc98ed163a9f043. Report an issue: GitHub.