{"record":{"id":"17a14d142ee38ae6","repo":"crowdsecurity/crowdsec","slug":"failed-to-load-server-cert-key-w","errorCode":null,"errorMessage":"failed to load server cert/key: %w","messagePattern":"failed to load server cert/key: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/config.go","lineNumber":179,"sourceCode":"\ts.metricsLevel = metricsLevel\n\n\terr := s.UnmarshalConfig(yamlConfig)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\nfunc (c *Configuration) NewTLSConfig() (*tls.Config, error) {\n\ttlsConfig := tls.Config{\n\t\tInsecureSkipVerify: c.TLS.InsecureSkipVerify,\n\t}\n\n\tif c.TLS.ServerCert != \"\" && c.TLS.ServerKey != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(c.TLS.ServerCert, c.TLS.ServerKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load server cert/key: %w\", err)\n\t\t}\n\n\t\ttlsConfig.Certificates = []tls.Certificate{cert}\n\t}\n\n\tif c.AuthType == \"mtls\" && c.TLS.CaCert != \"\" {\n\t\tcaCert, err := os.ReadFile(c.TLS.CaCert)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read ca cert: %w\", err)\n\t\t}\n\n\t\tcaCertPool, err := x509.SystemCertPool()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load system cert pool: %w\", err)\n\t\t}\n\n\t\tif caCertPool == nil {\n\t\t\tcaCertPool = x509.NewCertPool()","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/config.go#L161-L197","documentation":"NewTLSConfig builds the http module's TLS setup. When both ServerCert and ServerKey are configured, it loads them with tls.LoadX509KeyPair; any failure (missing files, bad PEM, key/cert mismatch) is returned as \"failed to load server cert/key: %w\". Used by both server mode and mTLS dialer setups.","triggerScenarios":"tls.LoadX509KeyPair(c.TLS.ServerCert, c.TLS.ServerKey) errors while configuring server-side TLS or mTLS client auth for the http acquisition module (callers: RunServer, NewDialer).","commonSituations":"Cert/key file paths wrong in acquis.yaml; certificate expired and replaced with mismatched files; concatenating certs into one file incorrectly; using client certs where server certs are expected; unreadable key file permissions.","solutions":["Check both configured paths exist and are readable: `ls -l` on ServerCert and ServerKey values.","Verify cert and key match: compare `openssl x509 -noout -modulus -in cert.pem` and `openssl rsa -noout -modulus -in key.pem`.","Validate the pair: `openssl x509 -in cert.pem -noout -text` to check expiry/PEM validity.","Check key file permissions (private keys often 0600 root-only)."],"exampleFix":"// before\nserver_cert: /etc/ssl/client.crt\nserver_key: /etc/ssl/client.key  # wrong pair\n// after\nserver_cert: /etc/crowdsec/ssl/server.crt\nserver_key: /etc/crowdsec/ssl/server.key","handlingStrategy":"validation","validationCode":"# verify the pair before configuring\nopenssl x509 -noout -modulus -in server.crt | openssl md5\nopenssl rsa  -noout -modulus -in server.key | openssl md5  # must match","typeGuard":null,"tryCatchPattern":"// load-and-verify early at deploy time\nif _, err := tls.LoadX509KeyPair(certPath, keyPath); err != nil {\n    return fmt.Errorf(\"deploy check failed: %w\", err)\n}","preventionTips":["Verify cert/key modulus match whenever renewing certificates.","Deploy cert paths via config management to avoid typos.","Keep private keys 0600 and owned by the crowdsec user.","Check expiry with `openssl x509 -enddate` before renewal deadlines."],"tags":["tls","certificates","http","configuration"],"backgroundTag":"tls-certificate-load-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}