{"record":{"id":"8f24135b9f99ee96","repo":"crowdsecurity/crowdsec","slug":"unknown-tls-client-verification-value-s","errorCode":null,"errorMessage":"unknown TLS client_verification value: %s","messagePattern":"unknown TLS client_verification value: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/tls.go","lineNumber":45,"sourceCode":"\t\t// sounds like a sane default: verify client cert if given, but don't make it mandatory\n\t\treturn tls.VerifyClientCertIfGiven, nil\n\t}\n\n\tswitch t.ClientVerification {\n\tcase \"NoClientCert\":\n\t\treturn tls.NoClientCert, nil\n\tcase \"RequestClientCert\":\n\t\tlog.Warn(\"RequestClientCert is insecure, please use VerifyClientCertIfGiven or RequireAndVerifyClientCert instead\")\n\t\treturn tls.RequestClientCert, nil\n\tcase \"RequireAnyClientCert\":\n\t\tlog.Warn(\"RequireAnyClientCert is insecure, please use VerifyClientCertIfGiven or RequireAndVerifyClientCert instead\")\n\t\treturn tls.RequireAnyClientCert, nil\n\tcase \"VerifyClientCertIfGiven\":\n\t\treturn tls.VerifyClientCertIfGiven, nil\n\tcase \"RequireAndVerifyClientCert\":\n\t\treturn tls.RequireAndVerifyClientCert, nil\n\tdefault:\n\t\treturn 0, fmt.Errorf(\"unknown TLS client_verification value: %s\", t.ClientVerification)\n\t}\n}\n\nfunc (t *TLSCfg) GetTLSConfig() (*tls.Config, error) {\n\tif t == nil {\n\t\treturn &tls.Config{}, nil\n\t}\n\n\tclientAuthType, err := t.GetAuthType()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tcaCertPool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\tlog.Warnf(\"Error loading system CA certificates: %s\", err)\n\t}\n","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/tls.go#L27-L63","documentation":"TLSCfg.GetAuthType translates the client_verification string into a crypto/tls.ClientAuthType. The switch accepts NoClientCert, RequestClientCert, RequireAnyClientCert, VerifyClientCertIfGiven, and RequireAndVerifyClientCert; any other value hits the default branch and returns this error, which propagates through GetTLSConfig and aborts TLS setup.","triggerScenarios":"The tls section of the API server config sets client_verification to a value outside the five supported enum strings — typos like 'require_and_verify', 'required', or mixed case ('RequireAndVerifyclientcert' — matching is case-sensitive).","commonSituations":"Operators copy mTLS snippets from nginx ('optional', 'required') or other servers whose enum names differ; editing api.server.tls.client_verification by hand with a wrong casing.","solutions":["Set client_verification to exactly one of: NoClientCert, RequestClientCert, RequireAnyClientCert, VerifyClientCertIfGiven, RequireAndVerifyClientCert.","Match Go's spelling, not nginx's — replace 'required' with RequireAndVerifyClientCert and 'optional' with VerifyClientCertIfGiven.","Check casing: the comparison is case-sensitive, so write the value in Go constant form (PascalCase).","If you don't need client certs, simply omit client_verification or set NoClientCert."],"exampleFix":"// before (api.server.tls in config.yaml)\ntls:\n  client_verification: required\n// after\ntls:\n  client_verification: RequireAndVerifyClientCert","handlingStrategy":"validation","validationCode":"var valid = []string{\"NoClientCert\", \"RequestClientCert\", \"RequireAnyClientCert\", \"VerifyClientCertIfGiven\", \"RequireAndVerifyClientCert\"}\nif !slices.Contains(valid, tlsCfg.ClientVerification) {\n    return fmt.Errorf(\"client_verification %q must be one of %v\", tlsCfg.ClientVerification, valid)\n}","typeGuard":null,"tryCatchPattern":"if _, err := tlsCfg.GetAuthType(); err != nil {\n    log.Fatalf(\"bad TLS config: %v\", err) // correct client_verification before starting LAPI\n}","preventionTips":["Use Go's exact ClientAuthType names (PascalCase) — not nginx/apache values.","Copy mTLS config snippets only from crowdsec docs, not other servers.","Validate the tls section with a schema check in deployment tooling."],"tags":["tls","mtls","config","validation"],"backgroundTag":"invalid-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}