crowdsecurity/crowdsec · error

failed to create tls config: %w

Error message

failed to create tls config: %w

What it means

RunServer wraps any error from the datasource's NewTLSConfig() when a TLS block is present. The TLS settings in the acquisition config could not be turned into a *tls.Config, so the HTTPS server cannot start.

Source

Thrown at pkg/acquisition/modules/http/run.go:226

	s.Server = &http.Server{
		Addr:      s.Config.ListenAddr,
		Handler:   mux,
		Protocols: &http.Protocols{},
	}

	s.Server.Protocols.SetHTTP1(true)
	s.Server.Protocols.SetUnencryptedHTTP2(true)
	s.Server.Protocols.SetHTTP2(true)

	if s.Config.Timeout != nil {
		s.Server.ReadTimeout = *s.Config.Timeout
	}

	if s.Config.TLS != nil {
		tlsConfig, err := s.Config.NewTLSConfig()
		if err != nil {
			return fmt.Errorf("failed to create tls config: %w", err)
		}

		s.logger.Tracef("tls config: %+v", tlsConfig)
		s.Server.TLSConfig = tlsConfig
	}

	listenConfig := &net.ListenConfig{}

	t.Go(func() error {
		defer trace.ReportPanic()

		if s.Config.ListenSocket == "" {
			return nil
		}

		s.logger.Infof("creating unix socket on %s", s.Config.ListenSocket)
		_ = os.Remove(s.Config.ListenSocket)

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the CA certificate path in the TLS config exists and is readable by the crowdsec process user.
2. Install/repair the system certificate bundle in the runtime environment.
3. Test the cert file is valid PEM: openssl x509 -in <ca.crt> -noout.
4. Check startup logs for the wrapped inner error (read-ca vs system-pool) to pick the right fix.

Example fix

# before
client_ca: /etc/ssl/certs/my-ca.pem   # file missing
# after
client_ca: /etc/crowdsec/ssl/ca.crt   # existing readable CA

if _, err := os.Stat(tlsConf.ClientCA); err != nil { return fmt.Errorf("CA file unreadable: %w", err) }

_, err := NewTLSConfig(conf); if err != nil { return fmt.Errorf("check TLS paths and system CA store: %w", err) }

When it happens

Trigger: Config.TLS is set and NewTLSConfig fails — typically 'failed to read ca cert' (CA file missing/unreadable) or 'failed to load system cert pool' from the wrapped call.

Common situations: Pointing client_ca_file/CA at a nonexistent or unreadable path; running in a container without the system CA store; typo in the TLS config file path.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• path must start with /
• chunk_size must be positive
• invalid HTTP status code
• allowed_ou configuration contains invalid empty string
• cannot use TLS with a unix socket

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0d6eceada5be6f90. Report an issue: GitHub.