{"record":{"id":"53476f9557037aa1","repo":"crowdsecurity/crowdsec","slug":"while-creating-tls-auth-for-agents-w","errorCode":null,"errorMessage":"while creating TLS auth for agents: %w","messagePattern":"while creating TLS auth for agents: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apiserver.go","lineNumber":569,"sourceCode":"\tif s.cfg.TLS == nil {\n\t\treturn nil\n\t}\n\n\t// TLS is configured: create the TLSAuth middleware for agents and bouncers\n\n\tcacheExpiration := time.Hour\n\tif s.cfg.TLS.CacheExpiration != nil {\n\t\tcacheExpiration = *s.cfg.TLS.CacheExpiration\n\t}\n\n\ts.controller.HandlerV1.Middlewares.JWT.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedAgentsOU, s.cfg.TLS.CRLPath,\n\t\tcacheExpiration,\n\t\tlog.WithFields(log.Fields{\n\t\t\t\"component\": \"tls-auth\",\n\t\t\t\"type\":      \"agent\",\n\t\t}))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating TLS auth for agents: %w\", err)\n\t}\n\n\ts.controller.HandlerV1.Middlewares.APIKey.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedBouncersOU, s.cfg.TLS.CRLPath,\n\t\tcacheExpiration,\n\t\tlog.WithFields(log.Fields{\n\t\t\t\"component\": \"tls-auth\",\n\t\t\t\"type\":      \"bouncer\",\n\t\t}))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating TLS auth for bouncers: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":551,"sourceCodeEnd":584,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apiserver.go#L551-L584","documentation":"InitController wraps the error from v1.NewTLSAuth when building the agent-side mTLS authentication middleware. NewTLSAuth parses the CA/CRL and validates the allowed agents OU against the presented certificates, so failures are certificate-material problems.","triggerScenarios":"InitController called with a TLS config where the CRL file (tls.crl_path) is missing/unparseable or the CA chain cannot be loaded for the agents TLS-auth middleware.","commonSituations":"crl_path set to a non-existent file; CRL in wrong format (must be PEM/DER x509); CA bundle path wrong; misconfigured allowed_agents_ou combined with bad cert material.","solutions":["Check tls.crl_path exists and is a valid x509 CRL (`openssl crl -in crl.pem -noout -text`).","Verify the CA cert used for mTLS loads: `openssl x509 -in ca.pem -noout`.","If you don't use CRLs, remove crl_path from the TLS config.","Regenerate the CRL after the CA changed (stale/mismatched CA-CRL pair)."],"exampleFix":"// before\napi:\n  server:\n    tls:\n      crl_path: /etc/crowdsec/ssl/missing.crl\n// after\napi:\n  server:\n    tls:\n      crl_path: /etc/crowdsec/ssl/ca.crl","handlingStrategy":"validation","validationCode":"// pre-flight before InitController with TLS\nif cfg.TLS != nil && cfg.TLS.CRLPath != \"\" {\n    data, err := os.ReadFile(cfg.TLS.CRLPath)\n    if err != nil {\n        return fmt.Errorf(\"CRL %s unreadable: %w\", cfg.TLS.CRLPath, err)\n    }\n    if _, err := x509.ParseRevocationList(data); err != nil {\n        return fmt.Errorf(\"CRL %s invalid: %w\", cfg.TLS.CRLPath, err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := server.InitController(); err != nil {\n    if strings.Contains(err.Error(), \"TLS auth for agents\") {\n        log.Fatalf(\"agent mTLS material invalid: %v\", err)\n    }\n    return err\n}","preventionTips":["Provision CRL and CA together whenever you rotate the CA.","Verify CRL files with openssl before deploying.","Only set crl_path when you actually publish a CRL.","Automate CRL freshness checks (expired CRLs break mTLS auth)."],"tags":["tls","mtls","agents"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}