{"record":{"id":"7b8b3dfcf505bc1e","repo":"crowdsecurity/crowdsec","slug":"mtls-is-selected-but-ca-cert-is-not-provided","errorCode":null,"errorMessage":"mtls is selected, but ca_cert is not provided","messagePattern":"mtls is selected, but ca_cert is not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/config.go","lineNumber":123,"sourceCode":"\t\tbaseErr := \"basic_auth is selected, but\"\n\t\tif c.BasicAuth == nil {\n\t\t\treturn errors.New(baseErr + \" basic_auth is not provided\")\n\t\t}\n\n\t\tif c.BasicAuth.Username == \"\" {\n\t\t\treturn errors.New(baseErr + \" username is not provided\")\n\t\t}\n\n\t\tif c.BasicAuth.Password == \"\" {\n\t\t\treturn errors.New(baseErr + \" password is not provided\")\n\t\t}\n\tcase \"headers\":\n\t\tif c.Headers == nil {\n\t\t\treturn errors.New(\"headers is selected, but headers is not provided\")\n\t\t}\n\tcase \"mtls\":\n\t\tif c.TLS == nil || c.TLS.CaCert == \"\" {\n\t\t\treturn errors.New(\"mtls is selected, but ca_cert is not provided\")\n\t\t}\n\tdefault:\n\t\treturn errors.New(\"invalid auth_type: must be one of basic_auth, headers, mtls\")\n\t}\n\n\tif c.TLS != nil {\n\t\tif c.TLS.ServerCert == \"\" {\n\t\t\treturn errors.New(\"server_cert is required\")\n\t\t}\n\n\t\tif c.TLS.ServerKey == \"\" {\n\t\t\treturn errors.New(\"server_key is required\")\n\t\t}\n\t}\n\n\tif c.MaxBodySize != nil && *c.MaxBodySize <= 0 {\n\t\treturn errors.New(\"max_body_size must be positive\")\n\t}","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/config.go#L105-L141","documentation":"The HTTP acquisition source config selected auth_type \"mtls\" (mutual TLS), but the client CA certificate path is missing. When mtls is chosen, the server must load a CA cert (tls.ca_cert) to verify client certificates; Validate() rejects the config if c.TLS is nil or c.TLS.CaCert is empty. This is a config-time validation error raised when loading an acquisition YAML file.","triggerScenarios":"A YAML acquisition file for the http source sets auth_type: mtls but omits the tls block entirely, or sets tls: with server_cert/server_key but no ca_cert (or ca_cert: \"\"). Configuration.Validate() (pkg/acquisition/modules/http/config.go:121-124) returns this error during Configure/UnmarshalConfig.","commonSituations":"Users copy an HTTPS listener example that only has server_cert/server_key and add auth_type: mtls without realizing the CA used to sign client certs must also be configured; indentation mistakes put ca_cert outside the tls block; strict YAML parsing silently maps ca_cert to nothing due to a typo (strict mode would actually flag unknown keys, so more often it's plain omission).","solutions":["Add a ca_cert entry under the tls block pointing to the PEM CA file used to sign/verify client certificates","If you do not actually need client-certificate authentication, change auth_type to basic_auth or headers","Verify the ca_cert key is correctly indented inside the tls: block and the YAML has no typos","Check that c.TLS itself is provided (a tls block with at least server_cert/server_key is required alongside ca_cert)"],"exampleFix":"# before\nsource: http\nlisten_addr: 127.0.0.1:8080\nauth_type: mtls\ntls:\n  server_cert: /etc/ssl/server.crt\n  server_key: /etc/ssl/server.key\n# after\nsource: http\nlisten_addr: 127.0.0.1:8080\nauth_type: mtls\ntls:\n  server_cert: /etc/ssl/server.crt\n  server_key: /etc/ssl/server.key\n  ca_cert: /etc/ssl/client-ca.crt","handlingStrategy":"validation","validationCode":"if cfg.AuthType == \"mtls\" && (cfg.TLS == nil || cfg.TLS.CaCert == \"\") {\n    return errors.New(\"auth_type mtls requires tls.ca_cert to be set\")\n}","typeGuard":"func mtlsConfigValid(c httpacquisition.Configuration) bool {\n    return c.AuthType != \"mtls\" || (c.TLS != nil && c.TLS.CaCert != \"\")\n}","tryCatchPattern":"if err := src.Configure(ctx, yamlCfg, logger, metricsLevel); err != nil {\n    if strings.Contains(err.Error(), \"ca_cert is not provided\") {\n        logger.Errorf(\"mtls acquisition config incomplete: %v\", err)\n    }\n    return err\n}","preventionTips":["Keep a validated example acquisition.yaml for mtls with all three tls keys present","Run cscli/crowdsec config check or start with a dry config load before deploying","Keep ca_cert, server_cert and server_key together in the tls block, never at top level"],"tags":["crowdsec","http-acquisition","mtls","config-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}