crowdsecurity/crowdsec · error

failed to load server cert/key: %w

Error message

failed to load server cert/key: %w

What it means

NewTLSConfig builds the http module's TLS setup. When both ServerCert and ServerKey are configured, it loads them with tls.LoadX509KeyPair; any failure (missing files, bad PEM, key/cert mismatch) is returned as "failed to load server cert/key: %w". Used by both server mode and mTLS dialer setups.

Source

Thrown at pkg/acquisition/modules/http/config.go:179

	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	return nil
}

func (c *Configuration) NewTLSConfig() (*tls.Config, error) {
	tlsConfig := tls.Config{
		InsecureSkipVerify: c.TLS.InsecureSkipVerify,
	}

	if c.TLS.ServerCert != "" && c.TLS.ServerKey != "" {
		cert, err := tls.LoadX509KeyPair(c.TLS.ServerCert, c.TLS.ServerKey)
		if err != nil {
			return nil, fmt.Errorf("failed to load server cert/key: %w", err)
		}

		tlsConfig.Certificates = []tls.Certificate{cert}
	}

	if c.AuthType == "mtls" && c.TLS.CaCert != "" {
		caCert, err := os.ReadFile(c.TLS.CaCert)
		if err != nil {
			return nil, fmt.Errorf("failed to read ca cert: %w", err)
		}

		caCertPool, err := x509.SystemCertPool()
		if err != nil {
			return nil, fmt.Errorf("failed to load system cert pool: %w", err)
		}

		if caCertPool == nil {
			caCertPool = x509.NewCertPool()

View on GitHub (pinned to 909b515798)

Solutions

1. Check both configured paths exist and are readable: `ls -l` on ServerCert and ServerKey values.
2. Verify cert and key match: compare `openssl x509 -noout -modulus -in cert.pem` and `openssl rsa -noout -modulus -in key.pem`.
3. Validate the pair: `openssl x509 -in cert.pem -noout -text` to check expiry/PEM validity.
4. Check key file permissions (private keys often 0600 root-only).

Example fix

// before
server_cert: /etc/ssl/client.crt
server_key: /etc/ssl/client.key  # wrong pair
// after
server_cert: /etc/crowdsec/ssl/server.crt
server_key: /etc/crowdsec/ssl/server.key

# verify the pair before configuring
openssl x509 -noout -modulus -in server.crt | openssl md5
openssl rsa  -noout -modulus -in server.key | openssl md5  # must match

// load-and-verify early at deploy time
if _, err := tls.LoadX509KeyPair(certPath, keyPath); err != nil {
    return fmt.Errorf("deploy check failed: %w", err)
}

When it happens

Trigger: tls.LoadX509KeyPair(c.TLS.ServerCert, c.TLS.ServerKey) errors while configuring server-side TLS or mTLS client auth for the http acquisition module (callers: RunServer, NewDialer).

Common situations: Cert/key file paths wrong in acquis.yaml; certificate expired and replaced with mismatched files; concatenating certs into one file incorrectly; using client certs where server certs are expected; unreadable key file permissions.

Related errors

• failed to read ca cert: %w
• failed to load system cert pool: %w
• missing TLS key file
• missing TLS cert file
• missing TLS key file

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/17a14d142ee38ae6. Report an issue: GitHub.