{"record":{"id":"04a76cd23b791903","repo":"crowdsecurity/crowdsec","slug":"failed-to-load-cacert-w","errorCode":null,"errorMessage":"failed to load cacert: %w","messagePattern":"failed to load cacert: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":199,"sourceCode":"\n\tif credTLS && credSocket {\n\t\treturn errors.New(\"cannot use TLS with a unix socket\")\n\t}\n\n\tif credTLSClientAuth && l.Credentials.Login != \"\" {\n\t\treturn errors.New(\"user/password authentication and TLS authentication are mutually exclusive\")\n\t}\n\n\tif l.InsecureSkipVerify == nil {\n\t\tapiclient.InsecureSkipVerify = false\n\t} else {\n\t\tapiclient.InsecureSkipVerify = *l.InsecureSkipVerify\n\t}\n\n\tif l.Credentials.CACertPath != \"\" {\n\t\tcaCert, err := os.ReadFile(l.Credentials.CACertPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to load cacert: %w\", err)\n\t\t}\n\n\t\tcaCertPool, err := x509.SystemCertPool()\n\t\tif err != nil {\n\t\t\tlog.Warningf(\"Error loading system CA certificates: %s\", err)\n\t\t}\n\n\t\tif caCertPool == nil {\n\t\t\tcaCertPool = x509.NewCertPool()\n\t\t}\n\n\t\tcaCertPool.AppendCertsFromPEM(caCert)\n\t\tapiclient.CaCertPool = caCertPool\n\t}\n\n\tif l.Credentials.CertPath != \"\" && l.Credentials.KeyPath != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(l.Credentials.CertPath, l.Credentials.KeyPath)\n\t\tif err != nil {","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L181-L217","documentation":"When the credentials configuration specifies a ca_cert_path, Load() reads that file with os.ReadFile to build the TLS CA pool. This error wraps the read failure, meaning the CA certificate file could not be loaded — most often because the path does not exist or is unreadable. It is thrown before any TLS handshake happens.","triggerScenarios":"Credentials.CACertPath is set in the api client config and os.ReadFile fails: nonexistent path, permission denied, path is a directory, or the file was deleted/moved after config was written.","commonSituations":"Wrong relative path in local_api_credentials.yaml (paths resolve relative to process CWD, not the config file); CA cert regenerated on LAPI but client still points at the old file; container image missing the mounted cert; typo like /etc/ssl/certs/ca-cert.cr instead of .crt.","solutions":["Check the path in the error's wrapped message with `ls -l <path>`; fix the ca_cert_path value to point at the real CA file.","Re-copy the CA certificate from the LAPI host (`/etc/crowdsec/ssl/ca.crt` by default) to the client.","Fix file permissions so the crowdsec user can read the cert (e.g. chmod 644).","Use an absolute path, since relative paths resolve against the daemon's working directory.","If TLS verification is intentionally not needed, remove ca_cert_path or set insecure_skip_verify (dev only)."],"exampleFix":"# before\nca_cert_path: /etc/crowdsec/ssl/ca.cr  # wrong name\n# after\nca_cert_path: /etc/crowdsec/ssl/ca.crt","handlingStrategy":"validation","validationCode":"if caPath != \"\" {\n    if _, err := os.Stat(caPath); err != nil {\n        return fmt.Errorf(\"CA cert not readable at %s: %w\", caPath, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := creds.Load(); err != nil {\n    var perr *fs.PathError\n    if errors.As(err, &perr) && strings.Contains(err.Error(), \"failed to load cacert\") {\n        return fmt.Errorf(\"CA cert %s missing/unreadable: %w\", perr.Path, err)\n    }\n    return err\n}","preventionTips":["Use absolute paths for ca_cert_path.","Deploy the LAPI CA cert with the same config-management run that sets ca_cert_path.","Verify readability as the service user, not root.","When LAPI certs are rotated, redistribute the CA to all agents."],"tags":["tls","file","config"],"backgroundTag":"file-read-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}