{"record":{"id":"ede5358682092841","repo":"crowdsecurity/crowdsec","slug":"https-server-failed-w","errorCode":null,"errorMessage":"https server failed: %w","messagePattern":"https server failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/run.go","lineNumber":253,"sourceCode":"\tt.Go(func() error {\n\t\tdefer trace.ReportPanic()\n\n\t\tif s.Config.ListenSocket == \"\" {\n\t\t\treturn nil\n\t\t}\n\n\t\ts.logger.Infof(\"creating unix socket on %s\", s.Config.ListenSocket)\n\t\t_ = os.Remove(s.Config.ListenSocket)\n\n\t\tlistener, err := listenConfig.Listen(ctx, \"unix\", s.Config.ListenSocket)\n\t\tif err != nil {\n\t\t\treturn csnet.WrapSockErr(err, s.Config.ListenSocket)\n\t\t}\n\n\t\tif s.Config.TLS != nil {\n\t\t\terr := s.Server.ServeTLS(listener, s.Config.TLS.ServerCert, s.Config.TLS.ServerKey)\n\t\t\tif err != nil && err != http.ErrServerClosed {\n\t\t\t\treturn fmt.Errorf(\"https server failed: %w\", err)\n\t\t\t}\n\t\t} else {\n\t\t\terr := s.Server.Serve(listener)\n\t\t\tif err != nil && err != http.ErrServerClosed {\n\t\t\t\treturn fmt.Errorf(\"http server failed: %w\", err)\n\t\t\t}\n\t\t}\n\n\t\treturn nil\n\t})\n\n\tt.Go(func() error {\n\t\tdefer trace.ReportPanic()\n\n\t\tif s.Config.ListenAddr == \"\" {\n\t\t\treturn nil\n\t\t}\n","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/run.go#L235-L271","documentation":"When the datasource is configured with a listen socket, RunServer calls ServeTLS on the prepared listener; any serve error other than the normal http.ErrServerClosed shutdown is wrapped as this error and aborts acquisition startup.","triggerScenarios":"TLS-enabled datasource using listen_socket; http.Server.ServeTLS fails because the server certificate/key files are missing, invalid, mismatched, or the TLS handshake setup fails.","commonSituations":"Wrong or expired server cert paths (server_cert/server_key); cert and key do not match; key file has permissions denied to the crowdsec user; cert not PEM-encoded.","solutions":["Verify server_cert and server_key paths exist and are readable; check with openssl x509/x509 in -noout.","Confirm the cert's public key matches the private key (compare modulus or use openssl pkey -pubout).","Renew expired certificates.","Check for the wrapped inner error (e.g. 'open ...: no such file') to identify which file is wrong."],"exampleFix":"# before\nserver_cert: /etc/crowdsec/ssl/old.crt  # expired\n# after\nserver_cert: /etc/crowdsec/ssl/renewed.crt\nserver_key: /etc/crowdsec/ssl/renewed.key","handlingStrategy":"try-catch","validationCode":"if _, err := tls.LoadX509KeyPair(cert, key); err != nil { return fmt.Errorf(\"cert/key invalid: %w\", err) }","typeGuard":null,"tryCatchPattern":"err := startServer(); if err != nil && !errors.Is(err, http.ErrServerClosed) { log.Fatalf(\"https server: %v\", err) }","preventionTips":["Pre-load the keypair at startup to validate cert/key match and expiry.","Monitor certificate expiry.","Use readable, correct-permission cert paths."],"tags":["tls","http","server"],"backgroundTag":"http-request-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}