{"record":{"id":"673e9b40ffa86dd2","repo":"crowdsecurity/crowdsec","slug":"while-creating-tls-config-w","errorCode":null,"errorMessage":"while creating TLS config: %w","messagePattern":"while creating TLS config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apiserver.go","lineNumber":335,"sourceCode":"\ts.apic.metricsTomb.Go(func() error {\n\t\tdefer trace.ReportPanic()\n\t\ts.apic.SendMetrics(ctx, make(chan bool))\n\t\treturn nil\n\t})\n\n\tif !s.cfg.DisableUsageMetricsExport {\n\t\ts.apic.metricsTomb.Go(func() error {\n\t\t\tdefer trace.ReportPanic()\n\t\t\ts.apic.SendUsageMetrics(ctx)\n\t\t\treturn nil\n\t\t})\n\t}\n}\n\nfunc (s *APIServer) Run(ctx context.Context, apiReady chan bool) error {\n\ttlsCfg, err := s.cfg.TLS.GetTLSConfig()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating TLS config: %w\", err)\n\t}\n\n\ts.httpServer = &http.Server{\n\t\tAddr:      s.cfg.ListenURI,\n\t\tHandler:   s.router,\n\t\tTLSConfig: tlsCfg,\n\t\tProtocols: &http.Protocols{},\n\t}\n\n\ts.httpServer.Protocols.SetHTTP1(true)\n\ts.httpServer.Protocols.SetUnencryptedHTTP2(true)\n\ts.httpServer.Protocols.SetHTTP2(true)\n\n\tif s.apic != nil {\n\t\ts.initAPIC(ctx)\n\t}\n\n\ts.httpServerTomb.Go(func() error {","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apiserver.go#L317-L353","documentation":"APIServer.Run wraps the error from csconfig's TLS.GetTLSConfig(), which loads the certificate/key files and optional CRL/mTLS material for the LAPI HTTPS listener. The server never starts listening. The wrapped error names the actual file or parse problem.","triggerScenarios":"Run called with a TLS-enabled LocalApiServerCfg where cert_file_path/key_file_path don't exist, are unreadable, the key doesn't match the cert, or the CRL is malformed.","commonSituations":"Cert path typo after moving config; cert renewed but key file replaced with wrong one; expired cert; unreadable files after permission change; bad CRL path.","solutions":["Read the wrapped cause: it names which file failed to load.","Verify tls.cert_file_path and tls.key_file_path exist and are readable by the crowdsec user.","Confirm the cert and key match: `openssl x509 -noout -modulus -in cert.pem | openssl md5` vs the key's.","Check validity: `openssl x509 -noout -dates -in cert.pem`.","If you don't want TLS on LAPI, remove the tls section from the api server config."],"exampleFix":"// before\napi:\n  server:\n    tls:\n      cert_file_path: /etc/crowdsec/ssl/lapi.crt\n      key_file_path: /etc/crowdsec/ssl/lapi.key\n// after\napi:\n  server:\n    tls:\n      cert_file_path: /etc/crowdsec/ssl/lapi.pem\n      key_file_path: /etc/crowdsec/ssl/lapi-key.pem","handlingStrategy":"validation","validationCode":"// pre-flight TLS material check\nif cfg.TLS != nil {\n    for _, f := range []string{cfg.TLS.CertFilePath, cfg.TLS.KeyFilePath} {\n        if _, err := os.Stat(f); err != nil {\n            return fmt.Errorf(\"TLS file %s missing: %w\", f, err)\n        }\n    }\n    if _, err := tls.LoadX509KeyPair(cfg.TLS.CertFilePath, cfg.TLS.KeyFilePath); err != nil {\n        return fmt.Errorf(\"TLS pair invalid: %w\", err)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := apiServer.Run(ctx, ready); err != nil {\n    if strings.Contains(err.Error(), \"while creating TLS config\") {\n        log.Fatalf(\"fix TLS cert/key files: %v\", err)\n    }\n    return err\n}","preventionTips":["Check cert expiry in monitoring and alert before renewal failure.","Deploy cert and key together from the same generation step.","Keep CRL paths optional — only set crl_path if the file is provisioned.","Run crowdsec as a user with read access to the SSL directory."],"tags":["tls","https","configuration"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}