{"record":{"id":"7440cc416e08a9db","repo":"crowdsecurity/crowdsec","slug":"cannot-use-tls-with-a-unix-socket","errorCode":null,"errorMessage":"cannot use TLS with a unix socket","messagePattern":"cannot use TLS with a unix socket","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":183,"sourceCode":"\t}\n\n\tif l.Credentials != nil && l.Credentials.URL != \"\" {\n\t\t// don't append a trailing slash if the URL is a unix socket\n\t\tif strings.HasPrefix(l.Credentials.URL, \"http\") && !strings.HasSuffix(l.Credentials.URL, \"/\") {\n\t\t\tl.Credentials.URL += \"/\"\n\t\t}\n\t}\n\n\t// is the configuration asking for client authentication via TLS?\n\tcredTLSClientAuth := l.Credentials.CertPath != \"\" || l.Credentials.KeyPath != \"\"\n\n\t// is the configuration asking for TLS encryption and server authentication?\n\tcredTLS := credTLSClientAuth || l.Credentials.CACertPath != \"\"\n\n\tcredSocket := strings.HasPrefix(l.Credentials.URL, \"/\")\n\n\tif credTLS && credSocket {\n\t\treturn errors.New(\"cannot use TLS with a unix socket\")\n\t}\n\n\tif credTLSClientAuth && l.Credentials.Login != \"\" {\n\t\treturn errors.New(\"user/password authentication and TLS authentication are mutually exclusive\")\n\t}\n\n\tif l.InsecureSkipVerify == nil {\n\t\tapiclient.InsecureSkipVerify = false\n\t} else {\n\t\tapiclient.InsecureSkipVerify = *l.InsecureSkipVerify\n\t}\n\n\tif l.Credentials.CACertPath != \"\" {\n\t\tcaCert, err := os.ReadFile(l.Credentials.CACertPath)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to load cacert: %w\", err)\n\t\t}\n","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L165-L201","documentation":"The LAPI client Load validates that TLS client-side settings and unix socket transport are not combined. TLS certificate verification and server authentication (ca_cert_path or client cert/key auth) only make sense over TCP, so a URL starting with '/' (unix socket) plus TLS credentials is rejected at config load time.","triggerScenarios":"config.yaml api.client has credentials.url pointing to a unix socket path (e.g. /run/crowdsec/lapi.sock) while also setting ca_cert, client cert/key, or a non-empty CACertPath; LocalApiClientCfg.Load() detects both conditions.","commonSituations":"Copying a TLS-enabled remote-API client config and switching to a local unix socket without removing ca/client cert entries; packaged configs that ship TLS blocks by default.","solutions":["Remove ca_cert_path and client cert/key entries from the api.client credentials when using a unix socket","Or switch the url back to an https:// address if TLS is actually required","Keep unix socket configs minimal: url, login, password only"],"exampleFix":"// before\napi:\n  client:\n    credentials:\n      url: /run/crowdsec/lapi.sock\n      ca_cert_path: /etc/crowdsec/ssl/ca.crt\n// after\napi:\n  client:\n    credentials:\n      url: /run/crowdsec/lapi.sock\n      login: lapi-user\n      password: secret","handlingStrategy":"validation","validationCode":"if strings.HasPrefix(l.Credentials.URL, \"/\") &&\n   (l.Credentials.CertPath != \"\" || l.Credentials.KeyPath != \"\" || l.Credentials.CACertPath != \"\") {\n    return errors.New(\"drop TLS settings when using a unix socket url\")\n}\nif err := l.Load(); err != nil { ... }","typeGuard":"func isUnixSocketURL(u string) bool { return strings.HasPrefix(u, \"/\") }","tryCatchPattern":"if err := clientCfg.Load(); err != nil {\n    return fmt.Errorf(\"lapi client config: %w\", err)\n}","preventionTips":["Keep unix-socket client configs to url/login/password only","When switching between TLS and socket setups, diff the credentials block","Document per-deployment (socket vs TCP) config templates"],"tags":["go","config","tls","unix-socket"],"backgroundTag":"conflicting-config-options","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}