{"record":{"id":"6a58564822964c13","repo":"crowdsecurity/crowdsec","slug":"while-creating-tls-auth-for-bouncers-w","errorCode":null,"errorMessage":"while creating TLS auth for bouncers: %w","messagePattern":"while creating TLS auth for bouncers: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apiserver.go","lineNumber":579,"sourceCode":"\n\ts.controller.HandlerV1.Middlewares.JWT.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedAgentsOU, s.cfg.TLS.CRLPath,\n\t\tcacheExpiration,\n\t\tlog.WithFields(log.Fields{\n\t\t\t\"component\": \"tls-auth\",\n\t\t\t\"type\":      \"agent\",\n\t\t}))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating TLS auth for agents: %w\", err)\n\t}\n\n\ts.controller.HandlerV1.Middlewares.APIKey.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedBouncersOU, s.cfg.TLS.CRLPath,\n\t\tcacheExpiration,\n\t\tlog.WithFields(log.Fields{\n\t\t\t\"component\": \"tls-auth\",\n\t\t\t\"type\":      \"bouncer\",\n\t\t}))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"while creating TLS auth for bouncers: %w\", err)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":561,"sourceCodeEnd":584,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apiserver.go#L561-L584","documentation":"Constructing the TLS-auth middleware for bouncers (v1.NewTLSAuth with AllowedBouncersOU, CRLPath and cache expiration) failed during LAPI controller initialization. The agent TLS-auth middleware was built just before with the same code path, so a failure here typically stems from bouncer-specific OU/CRL configuration — e.g. an unreadable or malformed CRL file.","triggerScenarios":"InitController called with TLS enabled where the CRL or CA material required for bouncer certificate validation is missing or invalid (allowed_bouncers_ou path).","commonSituations":"Bouncers on mTLS setups: crl_path points to an agent-only CRL; separate CA for bouncers not deployed; expired CRL revoked material parsing failure.","solutions":["Verify the CA/CRL pair for bouncers loads: `openssl crl -in crl.pem -noout -text`.","Ensure tls.crl_path is readable and covers bouncer certificates.","Confirm tls.allowed_bouncers_ou matches the OU actually present in bouncer certs.","Regenerate and redistribute the CRL if the CA was rotated."],"exampleFix":"// before\ntls:\n  crl_path: /etc/crowdsec/ssl/agents-only.crl\n// after\ntls:\n  crl_path: /etc/crowdsec/ssl/all-clients.crl","handlingStrategy":"validation","validationCode":"// pre-flight bouncer mTLS material\nif cfg.TLS != nil {\n    if cfg.TLS.AllowedBouncersOU != \"\" && cfg.TLS.CRLPath != \"\" {\n        if err := validateCRLForCA(cfg.TLS.CRLPath, bouncerCA); err != nil {\n            return fmt.Errorf(\"bouncer CRL/CA mismatch: %w\", err)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := server.InitController(); err != nil {\n    if strings.Contains(err.Error(), \"TLS auth for bouncers\") {\n        log.Fatalf(\"bouncer mTLS material invalid: %v\", err)\n    }\n    return err\n}","preventionTips":["Use one CRL covering both agent and bouncer certs, or split paths correctly.","Verify bouncer certs carry the OU listed in allowed_bouncers_ou.","Rotate bouncer CA and CRL in the same deployment step.","Test a bouncer mTLS handshake after any cert infrastructure change."],"tags":["tls","mtls","bouncers"],"backgroundTag":"file-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}