{"record":{"id":"0d6eceada5be6f90","repo":"crowdsecurity/crowdsec","slug":"failed-to-create-tls-config-w","errorCode":null,"errorMessage":"failed to create tls config: %w","messagePattern":"failed to create tls config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/run.go","lineNumber":226,"sourceCode":"\n\ts.Server = &http.Server{\n\t\tAddr:      s.Config.ListenAddr,\n\t\tHandler:   mux,\n\t\tProtocols: &http.Protocols{},\n\t}\n\n\ts.Server.Protocols.SetHTTP1(true)\n\ts.Server.Protocols.SetUnencryptedHTTP2(true)\n\ts.Server.Protocols.SetHTTP2(true)\n\n\tif s.Config.Timeout != nil {\n\t\ts.Server.ReadTimeout = *s.Config.Timeout\n\t}\n\n\tif s.Config.TLS != nil {\n\t\ttlsConfig, err := s.Config.NewTLSConfig()\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to create tls config: %w\", err)\n\t\t}\n\n\t\ts.logger.Tracef(\"tls config: %+v\", tlsConfig)\n\t\ts.Server.TLSConfig = tlsConfig\n\t}\n\n\tlistenConfig := &net.ListenConfig{}\n\n\tt.Go(func() error {\n\t\tdefer trace.ReportPanic()\n\n\t\tif s.Config.ListenSocket == \"\" {\n\t\t\treturn nil\n\t\t}\n\n\t\ts.logger.Infof(\"creating unix socket on %s\", s.Config.ListenSocket)\n\t\t_ = os.Remove(s.Config.ListenSocket)\n","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/run.go#L208-L244","documentation":"RunServer wraps any error from the datasource's NewTLSConfig() when a TLS block is present. The TLS settings in the acquisition config could not be turned into a *tls.Config, so the HTTPS server cannot start.","triggerScenarios":"Config.TLS is set and NewTLSConfig fails — typically 'failed to read ca cert' (CA file missing/unreadable) or 'failed to load system cert pool' from the wrapped call.","commonSituations":"Pointing client_ca_file/CA at a nonexistent or unreadable path; running in a container without the system CA store; typo in the TLS config file path.","solutions":["Verify the CA certificate path in the TLS config exists and is readable by the crowdsec process user.","Install/repair the system certificate bundle in the runtime environment.","Test the cert file is valid PEM: openssl x509 -in <ca.crt> -noout.","Check startup logs for the wrapped inner error (read-ca vs system-pool) to pick the right fix."],"exampleFix":"# before\nclient_ca: /etc/ssl/certs/my-ca.pem   # file missing\n# after\nclient_ca: /etc/crowdsec/ssl/ca.crt   # existing readable CA","handlingStrategy":"validation","validationCode":"if _, err := os.Stat(tlsConf.ClientCA); err != nil { return fmt.Errorf(\"CA file unreadable: %w\", err) }","typeGuard":null,"tryCatchPattern":"_, err := NewTLSConfig(conf); if err != nil { return fmt.Errorf(\"check TLS paths and system CA store: %w\", err) }","preventionTips":["Verify all cert paths before deployment with os.Stat + openssl parse.","Fail fast in a startup self-check.","Keep CA bundles installed in the runtime image."],"tags":["tls","config","http"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}