{"record":{"id":"ae4a55f12fae98a4","repo":"crowdsecurity/crowdsec","slug":"failed-to-load-system-cert-pool-w","errorCode":null,"errorMessage":"failed to load system cert pool: %w","messagePattern":"failed to load system cert pool: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/config.go","lineNumber":193,"sourceCode":"\n\tif c.TLS.ServerCert != \"\" && c.TLS.ServerKey != \"\" {\n\t\tcert, err := tls.LoadX509KeyPair(c.TLS.ServerCert, c.TLS.ServerKey)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load server cert/key: %w\", err)\n\t\t}\n\n\t\ttlsConfig.Certificates = []tls.Certificate{cert}\n\t}\n\n\tif c.AuthType == \"mtls\" && c.TLS.CaCert != \"\" {\n\t\tcaCert, err := os.ReadFile(c.TLS.CaCert)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read ca cert: %w\", err)\n\t\t}\n\n\t\tcaCertPool, err := x509.SystemCertPool()\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to load system cert pool: %w\", err)\n\t\t}\n\n\t\tif caCertPool == nil {\n\t\t\tcaCertPool = x509.NewCertPool()\n\t\t}\n\n\t\tcaCertPool.AppendCertsFromPEM(caCert)\n\t\ttlsConfig.ClientCAs = caCertPool\n\t\ttlsConfig.ClientAuth = tls.RequireAndVerifyClientCert\n\t}\n\n\treturn &tlsConfig, nil\n}\n","sourceCodeStart":175,"sourceCodeEnd":207,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/config.go#L175-L207","documentation":"NewTLSConfig in the http acquisition module wraps any error returned by crypto/x509's SystemCertPool(). The system pool loader failed (it can fail on malformed system cert store state or unsupported platforms), so a TLS client/server cannot be built with the default trust store.","triggerScenarios":"Configuration has a TLS block; NewTLSConfig calls x509.SystemCertPool() and it returns a non-nil error, e.g. corrupted/unreadable OS certificate store or a platform where the pool cannot be loaded.","commonSituations":"Running in a minimal/slim container with a broken or absent /etc/ssl/certs store; unusual platforms (e.g. some Windows states) where Go's system pool loader fails; misconfigured SSL_CERT_FILE/SSL_CERT_DIR env vars pointing to unreadable paths.","solutions":["Repair the system CA store: reinstall ca-certificates (apt-get install/reinstall ca-certificates, update-ca-certificates on Debian/Ubuntu; update-ca-trust on RHEL).","Check SSL_CERT_FILE / SSL_CERT_DIR env vars point to readable, valid PEM files/dirs.","Use a supported base image (e.g. debian:bookworm-slim or alpine with ca-certificates installed).","If the platform cannot provide a pool, set the TLS ca cert explicitly in the datasource config — the code reads the CA cert before this call and falls back to an empty pool if SystemCertPool returns nil without error."],"exampleFix":"// before (environment fix)\nFROM scratch\n// after\nFROM alpine:3.19\nRUN apk add --no-cache ca-certificates","handlingStrategy":"validation","validationCode":"if _, err := x509.SystemCertPool(); err != nil { return fmt.Errorf(\"system cert pool unavailable, install ca-certificates: %w\", err) }","typeGuard":null,"tryCatchPattern":"cfg, err := NewTLSConfig(conf); if err != nil { log.Error(err); os.Exit(1) // fail fast at startup }","preventionTips":["Always install ca-certificates in container images.","Never override SSL_CERT_FILE/SSL_CERT_DIR unless required.","Validate TLS config in CI by constructing NewTLSConfig once at boot."],"tags":["tls","x509","certificates","http"],"backgroundTag":"missing-env-var","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}