What causes "client certificate is expired" in crowdsecurity/crowdsec?

Generate a new client certificate (cscli bouncers new / cscli users new for the client) and install it

client certificate is expired

Error message

client certificate is expired

What it means

After OU checks pass, ValidateCert checks the leaf certificate's NotAfter via ta.isExpired. If the certificate's validity period has elapsed, the client cert is rejected even if it would otherwise authenticate; it must be renewed.

Source

Thrown at pkg/apiserver/middlewares/v1/tls_auth.go:122

	if c.Request.TLS == nil || len(c.Request.TLS.PeerCertificates) == 0 {
		return "", errors.New("no certificate in request")
	}

	if len(c.Request.TLS.VerifiedChains) == 0 {
		return "", errors.New("no verified cert in request")
	}

	// although there can be multiple chains, the leaf certificate is the same
	// we take the first one
	leaf = c.Request.TLS.VerifiedChains[0][0]

	if err := ta.checkAllowedOU(leaf.Subject.OrganizationalUnit); err != nil {
		return "", err
	}

	if ta.isExpired(leaf) {
		return "", errors.New("client certificate is expired")
	}

	if validErr, cached := ta.revocationCache.Get(leaf); cached {
		if validErr != nil {
			return "", fmt.Errorf("(cache) %w", validErr)
		}

		return leaf.Subject.CommonName, nil
	}

	okToCache := true

	var (
		validErr   error
		couldCheck bool
	)

	for _, chain := range c.Request.TLS.VerifiedChains {

View on GitHub (pinned to 909b515798)

Solutions

Generate a new client certificate (cscli bouncers new / cscli users new for the client) and install it
Sync clocks via NTP if a clock skew is suspected
Set up rotation/monitoring so certificates are renewed before expiry

Defensive patterns

Strategy: validation

Validate before calling

// preflight: fail fast on an expired cert before calling the API
if time.Now().After(cert.NotAfter) {
    return errors.New("client cert expired; reissue via cscli")
}

Try / catch

_, err := ta.ValidateCert(c)
if err != nil && strings.Contains(err.Error(), "expired") {
    // signal re-enrollment to the client rather than plain 401
}

Prevention

Automate certificate renewal before NotAfter
Monitor certificate expiry (alert at e.g. 30 days remaining)
Run NTP on server and clients to avoid clock-skew false expiry

When it happens

Trigger: ValidateCert called by authTLS when the presented client certificate's expiration time is before the current time.

Common situations: Long-lived deployments where the bouncer/user certificate quietly expired; clocks skewed on server or client; certificate issued with a short validity and never rotated.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/8f161f75a77f3d9a. Report an issue: GitHub.