{"record":{"id":"4b8695094fc719ac","repo":"crowdsecurity/crowdsec","slug":"machine-s-attempted-to-auth-with-tls-cert-but-it","errorCode":null,"errorMessage":"machine %s attempted to auth with TLS cert but it is configured to use %s","messagePattern":"machine (.+?) attempted to auth with TLS cert but it is configured to use (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":103,"sourceCode":"\t\tpwd, err := GenerateAPIKey(dummyAPIKeySize)\n\t\tif err != nil {\n\t\t\tlogger.WithField(\"cn\", extractedCN).\n\t\t\t\tErrorf(\"error generating password: %s\", err)\n\n\t\t\treturn nil, errors.New(\"error generating password\")\n\t\t}\n\n\t\tpassword := strfmt.Password(pwd)\n\n\t\tret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, \"\", true, true, types.TlsAuthType)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while creating machine entry for %s: %w\", ret.machineID, err)\n\t\t}\n\t} else if err != nil {\n\t\treturn nil, fmt.Errorf(\"while selecting machine entry for %s: %w\", ret.machineID, err)\n\t} else {\n\t\tif ret.clientMachine.AuthType != types.TlsAuthType {\n\t\t\treturn nil, fmt.Errorf(\"machine %s attempted to auth with TLS cert but it is configured to use %s\", ret.machineID, ret.clientMachine.AuthType)\n\t\t}\n\n\t\tret.machineID = ret.clientMachine.MachineId\n\t}\n\n\tloginInput := struct {\n\t\tScenarios []string `json:\"scenarios\"`\n\t}{\n\t\tScenarios: []string{},\n\t}\n\n\terr = c.ShouldBindJSON(&loginInput)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"missing scenarios list in login request for TLS auth: %w\", err)\n\t}\n\n\tret.scenariosInput = loginInput.Scenarios\n","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L85-L121","documentation":"The machine exists in the database but its stored auth_type is not 'tls', so authenticating with an x509 certificate is refused. CrowdSec enforces one auth type per machine to prevent a password-registered agent from silently switching to cert auth.","triggerScenarios":"Authenticator -> authTLS: SelectMachine returns the row and ret.clientMachine.AuthType != types.TlsAuthType (it is 'password'), meaning the machine was previously registered with 'cscli machines add' (password) and now logs in via mTLS cert.","commonSituations":"Operator registers an agent with a password, then switches it to cert-based auth without updating the DB row; mixed deployments where some agents use passwords and the same machine ID is reused; automation re-registering machines with a different method.","solutions":["Delete the existing machine entry and re-enroll: cscli machines delete <machineID>, then re-register via TLS","Or update the auth type: cscli machines add <machineID> --auth-type tls (or update the DB row auth_type)","Align client configuration: either always use password auth (api client credentials) or always TLS certs for that machine","Check which auth flow your deployment tooling (ansible/terraform) registers agents with and make it consistent"],"exampleFix":"// before: machine registered with password, client switches to certs\n// fix on LAPI host:\ncscli machines delete myagent\ncscli machines add myagent --auth-type tls --force","handlingStrategy":"validation","validationCode":"// check the machine's expected auth type before configuring TLS login\ncscli machines list -o json | jq '.[] | select(.machineId==\"myagent\") | .authType'\n// must output \"tls\" before using cert auth for that machine","typeGuard":null,"tryCatchPattern":"_, err := client.LoginTLS(ctx)\nif err != nil && strings.Contains(err.Error(), \"configured to use\") {\n    return fmt.Errorf(\"machine registered with a different auth type; delete and re-enroll: %w\", err)\n}","preventionTips":["Check 'cscli machines list' Auth Type before switching an agent between cert and password auth","Standardize one auth method per machine in deployment automation","Delete + re-enroll machines whenever the auth method changes","Document the auth type of each watcher in your inventory/config management"],"tags":["tls","auth","mtls","machines","config"],"backgroundTag":"auth-type-mismatch","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}