{"record":{"id":"16696f447051cb1a","repo":"crowdsecurity/crowdsec","slug":"server-cert-is-required","errorCode":null,"errorMessage":"server_cert is required","messagePattern":"server_cert is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/config.go","lineNumber":131,"sourceCode":"\n\t\tif c.BasicAuth.Password == \"\" {\n\t\t\treturn errors.New(baseErr + \" password is not provided\")\n\t\t}\n\tcase \"headers\":\n\t\tif c.Headers == nil {\n\t\t\treturn errors.New(\"headers is selected, but headers is not provided\")\n\t\t}\n\tcase \"mtls\":\n\t\tif c.TLS == nil || c.TLS.CaCert == \"\" {\n\t\t\treturn errors.New(\"mtls is selected, but ca_cert is not provided\")\n\t\t}\n\tdefault:\n\t\treturn errors.New(\"invalid auth_type: must be one of basic_auth, headers, mtls\")\n\t}\n\n\tif c.TLS != nil {\n\t\tif c.TLS.ServerCert == \"\" {\n\t\t\treturn errors.New(\"server_cert is required\")\n\t\t}\n\n\t\tif c.TLS.ServerKey == \"\" {\n\t\t\treturn errors.New(\"server_key is required\")\n\t\t}\n\t}\n\n\tif c.MaxBodySize != nil && *c.MaxBodySize <= 0 {\n\t\treturn errors.New(\"max_body_size must be positive\")\n\t}\n\n\t/*\n\t\tif hc.ChunkSize != nil && *hc.ChunkSize <= 0 {\n\t\t\treturn errors.New(\"chunk_size must be positive\")\n\t\t}\n\t*/\n\n\tif c.CustomStatusCode != nil {","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/config.go#L113-L149","documentation":"A tls block was provided in the http source config, but server_cert is empty. Whenever TLS is configured (c.TLS != nil), Validate() requires both a server certificate and key so the HTTPS listener can present itself to clients. The error is returned before the cert file is ever loaded.","triggerScenarios":"YAML sets tls: with only ca_cert (e.g. when using auth_type: mtls the user put ca_cert but no server_cert/server_key), or an empty tls: {} block, or server_cert key misspelled/omitted. Raised by Configuration.Validate() (config.go:129-132).","commonSituations":"mTLS users who add ca_cert for client verification but forget the server's own certificate; configs where tls is present but mostly empty; copy-paste examples that only show the CA path; strict-mode YAML typos resolved by omission.","solutions":["Add server_cert under the tls block with the path to the server's PEM certificate","Add server_key too — validation will demand it next if only server_cert is set","If no TLS is intended at all, remove the tls block (note: auth_type mtls and HTTPS require TLS, so you cannot drop it in that case)","Confirm the key name is exactly server_cert and it is indented under tls:"],"exampleFix":"# before\nsource: http\nlisten_addr: 127.0.0.1:8080\nauth_type: mtls\ntls:\n  ca_cert: /etc/ssl/client-ca.crt\n# after\nsource: http\nlisten_addr: 127.0.0.1:8080\nauth_type: mtls\ntls:\n  server_cert: /etc/ssl/server.crt\n  server_key: /etc/ssl/server.key\n  ca_cert: /etc/ssl/client-ca.crt","handlingStrategy":"validation","validationCode":"if cfg.TLS != nil && cfg.TLS.ServerCert == \"\" {\n    return errors.New(\"tls block present but server_cert is missing\")\n}","typeGuard":"func tlsComplete(c *httpacquisition.TLSConfig) bool {\n    return c != nil && c.ServerCert != \"\" && c.ServerKey != \"\"\n}","tryCatchPattern":"if err := src.Configure(ctx, yamlCfg, logger, metricsLevel); err != nil {\n    if strings.Contains(err.Error(), \"server_cert is required\") {\n        logger.Error(\"http source: tls configured without server_cert\")\n    }\n    return err\n}","preventionTips":["Never emit an empty/partial tls: block from templates — omit it entirely if TLS is unused","When enabling mtls, provision all of server_cert, server_key and ca_cert together","Test config load in a staging environment before production rollout"],"tags":["crowdsec","http-acquisition","tls","config-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}