{"record":{"id":"c78b4b7ea662fc58","repo":"crowdsecurity/crowdsec","slug":"unable-to-load-system-ca-certificates-w","errorCode":null,"errorMessage":"unable to load system CA certificates: %w","messagePattern":"unable to load system CA certificates: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/kafka/config.go","lineNumber":121,"sourceCode":"\ttlsConfig := tls.Config{\n\t\tInsecureSkipVerify: c.TLS.InsecureSkipVerify,\n\t}\n\n\tcert, err := tls.LoadX509KeyPair(c.TLS.ClientCert, c.TLS.ClientKey)\n\tif err != nil {\n\t\treturn &tlsConfig, err\n\t}\n\n\ttlsConfig.Certificates = []tls.Certificate{cert}\n\n\tcaCert, err := os.ReadFile(c.TLS.CaCert)\n\tif err != nil {\n\t\treturn &tlsConfig, err\n\t}\n\n\tcaCertPool, err := x509.SystemCertPool()\n\tif err != nil {\n\t\treturn &tlsConfig, fmt.Errorf(\"unable to load system CA certificates: %w\", err)\n\t}\n\n\tif caCertPool == nil {\n\t\tcaCertPool = x509.NewCertPool()\n\t}\n\n\tcaCertPool.AppendCertsFromPEM(caCert)\n\ttlsConfig.RootCAs = caCertPool\n\n\treturn &tlsConfig, err\n}\n\nfunc (c *Configuration) NewDialer() (*kafka.Dialer, error) {\n\tdialer := &kafka.Dialer{}\n\ttimeoutDuration := time.Duration(10) * time.Second\n\n\tif c.Timeout != \"\" {\n\t\tintTimeout, err := strconv.Atoi(c.Timeout)","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/kafka/config.go#L103-L139","documentation":"Returned by Configuration.NewTLSConfig when x509.SystemCertPool() fails while building TLS settings for the kafka dialer. SystemCertPool reads the OS trust store, so this indicates the system CA bundle is unavailable or unreadable in the environment. The error is wrapped with the underlying cause (%w).","triggerScenarios":"A kafka datasource with a `tls:` block set triggers NewTLSConfig; x509.SystemCertPool() errors when the platform trust store cannot be located/read — typically a slim/alpine or scratch container missing ca-certificates, or a Windows host where it is unsupported.","commonSituations":"Running crowdsec in a distroless/scratch/alpine image without the ca-certificates package; minimal container images built from scratch; stripped-down appliance OSes.","solutions":["Install the CA bundle in the image: `apk add ca-certificates` (alpine) or `apt-get install -y ca-certificates` (debian)","Verify /etc/ssl/certs/ca-certificates.crt exists and is readable","As a workaround in degraded environments, note the code falls back to an empty pool only when SystemCertPool returns nil without error — an actual error must still be fixed at the OS level","Check the wrapped %w error text to confirm the platform-specific cause"],"exampleFix":"// Dockerfile before\nFROM golang:1.xx-alpine\n// after\nFROM golang:1.xx-alpine\nRUN apk add --no-cache ca-certificates","handlingStrategy":"try-catch","validationCode":"// guard at container/image build time\n// RUN test -r /etc/ssl/certs/ca-certificates.crt || (apk add ca-certificates)","typeGuard":null,"tryCatchPattern":"tlsCfg, err := cfg.NewTLSConfig()\nif err != nil {\n    var sysErr error\n    if errors.As(err, &sysErr) && strings.Contains(err.Error(), \"system CA\") {\n        logger.Warn(\"install ca-certificates in the image\")\n    }\n    return err\n}","preventionTips":["Base images on ones that include ca-certificates","Add ca-certificates to Dockerfile even for scratch/alpine builds","Smoke-test TLS connectivity to the broker at deploy time"],"tags":["tls","kafka","certificates","container"],"backgroundTag":"missing-env-var","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}