{"record":{"id":"c0abaf3436808323","repo":"crowdsecurity/crowdsec","slug":"server-key-is-required","errorCode":null,"errorMessage":"server_key is required","messagePattern":"server_key is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/config.go","lineNumber":135,"sourceCode":"\tcase \"headers\":\n\t\tif c.Headers == nil {\n\t\t\treturn errors.New(\"headers is selected, but headers is not provided\")\n\t\t}\n\tcase \"mtls\":\n\t\tif c.TLS == nil || c.TLS.CaCert == \"\" {\n\t\t\treturn errors.New(\"mtls is selected, but ca_cert is not provided\")\n\t\t}\n\tdefault:\n\t\treturn errors.New(\"invalid auth_type: must be one of basic_auth, headers, mtls\")\n\t}\n\n\tif c.TLS != nil {\n\t\tif c.TLS.ServerCert == \"\" {\n\t\t\treturn errors.New(\"server_cert is required\")\n\t\t}\n\n\t\tif c.TLS.ServerKey == \"\" {\n\t\t\treturn errors.New(\"server_key is required\")\n\t\t}\n\t}\n\n\tif c.MaxBodySize != nil && *c.MaxBodySize <= 0 {\n\t\treturn errors.New(\"max_body_size must be positive\")\n\t}\n\n\t/*\n\t\tif hc.ChunkSize != nil && *hc.ChunkSize <= 0 {\n\t\t\treturn errors.New(\"chunk_size must be positive\")\n\t\t}\n\t*/\n\n\tif c.CustomStatusCode != nil {\n\t\tstatusText := http.StatusText(*c.CustomStatusCode)\n\t\tif statusText == \"\" {\n\t\t\treturn errors.New(\"invalid HTTP status code\")\n\t\t}","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/config.go#L117-L153","documentation":"A tls block was provided in the http source config, but server_key is empty. Validate() requires both server_cert and server_key whenever TLS is configured, since the HTTPS server needs the private key matching its certificate. This fires immediately after the server_cert check passes.","triggerScenarios":"YAML sets tls: with server_cert but omits server_key, or server_key is empty due to a misspelled key name or wrong indentation. Raised by Configuration.Validate() (config.go:133-136).","commonSituations":"Users set both cert and key to the same file and then remove the key entry; split cert/key files where only the cert was copied into the config; templating systems that render the server_key field empty when a secret is missing.","solutions":["Add server_key under the tls block pointing to the PEM private key file matching server_cert","Ensure the private key was actually deployed to the host and the path is correct (next failure would be a load error in NewTLSConfig)","Fix indentation/typo if the key exists in the YAML but isn't being parsed into the struct","If TLS is not intended, remove the whole tls block instead of leaving a partial one"],"exampleFix":"# before\ntls:\n  server_cert: /etc/ssl/server.crt\n# after\ntls:\n  server_cert: /etc/ssl/server.crt\n  server_key: /etc/ssl/server.key","handlingStrategy":"validation","validationCode":"if cfg.TLS != nil && cfg.TLS.ServerKey == \"\" {\n    return errors.New(\"tls block present but server_key is missing\")\n}","typeGuard":"func hasServerKeyPair(c *httpacquisition.TLSConfig) bool {\n    return c != nil && c.ServerCert != \"\" && c.ServerKey != \"\"\n}","tryCatchPattern":"if err := src.Configure(ctx, yamlCfg, logger, metricsLevel); err != nil {\n    if strings.Contains(err.Error(), \"server_key is required\") {\n        logger.Error(\"http source: tls configured without server_key\")\n    }\n    return err\n}","preventionTips":["Provision certificate and private key as a pair and reference both paths in config","Verify rendered YAML from templating/secret managers actually populates server_key","Check key file permissions and paths on the target host as a follow-up after validation passes"],"tags":["crowdsec","http-acquisition","tls","config-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}