rustfs/rustfs · error · EnrollmentError

CLUSTER_MISMATCH

CLUSTER_MISMATCH

Error message

the response names a different cluster than the challenge it answers

What it means

The cluster identifier in the enrollment response does not match the cluster bound into the challenge it answers. Like the organization check, this ensures the response targets the exact cluster the challenge was minted for; a mismatch indicates cross-cluster confusion or tampering, and enrollment is rejected.

Source

Thrown at rustfs/src/connect/offline/enrollment.rs:202

    #[error("the trust chain is not issued by a root pinned in this build")]
    EnrollmentRootUnknown,

    #[error("a trust link is invalid, misordered, or outside its validity at the challenge issuedAt")]
    TrustChainInvalid,

    #[error("connectKeyId is not the subject of the last trust link")]
    ConnectKeyUnchained,

    #[error("no issued challenge matches this challengeId")]
    ChallengeUnknown,

    #[error("the challenge is not yet valid at the evaluation time")]
    ChallengeNotYetValid,

    #[error("the challenge has expired at the evaluation time")]
    ChallengeExpired,

    #[error("the response nonce or challengeProof is not the one issued for this challenge")]
    ChallengeProofInvalid,

    #[error("the response does not prove possession of the device key it presents")]
    DeviceProofInvalid,

    #[error("the challenge was already consumed")]
    EnrollmentReplayed,

    #[error("the response names a different organization than the challenge it answers")]
    OrganizationMismatch,

    #[error("the response names a different cluster than the challenge it answers")]
    ClusterMismatch,

    /// The artifact could not be read as a signed enrolment document at all: the
    /// envelope, the base64 of the signed octets, or a field the frozen order
    /// reads before the signature verifies did not parse.
    #[error("the offline enrollment document is not well formed")]

View on GitHub (pinned to 5dca076efe)

Solutions

  1. Regenerate the exchange for the intended cluster
  2. Verify cluster identifiers match between challenge and response
  3. Restart enrollment against the correct cluster
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at rustfs/src/connect/offline/enrollment.rs:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of rustfs/rustfs@5dca076efe (2026-08-23). Data as JSON: /api/errors/0759d0a888d2efce. Report an issue: GitHub.