crowdsecurity/crowdsec · error

failed to load system cert pool: %w

Error message

failed to load system cert pool: %w

What it means

NewTLSConfig in the http acquisition module wraps any error returned by crypto/x509's SystemCertPool(). The system pool loader failed (it can fail on malformed system cert store state or unsupported platforms), so a TLS client/server cannot be built with the default trust store.

Source

Thrown at pkg/acquisition/modules/http/config.go:193

	if c.TLS.ServerCert != "" && c.TLS.ServerKey != "" {
		cert, err := tls.LoadX509KeyPair(c.TLS.ServerCert, c.TLS.ServerKey)
		if err != nil {
			return nil, fmt.Errorf("failed to load server cert/key: %w", err)
		}

		tlsConfig.Certificates = []tls.Certificate{cert}
	}

	if c.AuthType == "mtls" && c.TLS.CaCert != "" {
		caCert, err := os.ReadFile(c.TLS.CaCert)
		if err != nil {
			return nil, fmt.Errorf("failed to read ca cert: %w", err)
		}

		caCertPool, err := x509.SystemCertPool()
		if err != nil {
			return nil, fmt.Errorf("failed to load system cert pool: %w", err)
		}

		if caCertPool == nil {
			caCertPool = x509.NewCertPool()
		}

		caCertPool.AppendCertsFromPEM(caCert)
		tlsConfig.ClientCAs = caCertPool
		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
	}

	return &tlsConfig, nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Repair the system CA store: reinstall ca-certificates (apt-get install/reinstall ca-certificates, update-ca-certificates on Debian/Ubuntu; update-ca-trust on RHEL).
2. Check SSL_CERT_FILE / SSL_CERT_DIR env vars point to readable, valid PEM files/dirs.
3. Use a supported base image (e.g. debian:bookworm-slim or alpine with ca-certificates installed).
4. If the platform cannot provide a pool, set the TLS ca cert explicitly in the datasource config — the code reads the CA cert before this call and falls back to an empty pool if SystemCertPool returns nil without error.

Example fix

// before (environment fix)
FROM scratch
// after
FROM alpine:3.19
RUN apk add --no-cache ca-certificates

if _, err := x509.SystemCertPool(); err != nil { return fmt.Errorf("system cert pool unavailable, install ca-certificates: %w", err) }

cfg, err := NewTLSConfig(conf); if err != nil { log.Error(err); os.Exit(1) // fail fast at startup }

When it happens

Trigger: Configuration has a TLS block; NewTLSConfig calls x509.SystemCertPool() and it returns a non-nil error, e.g. corrupted/unreadable OS certificate store or a platform where the pool cannot be loaded.

Common situations: Running in a minimal/slim container with a broken or absent /etc/ssl/certs store; unusual platforms (e.g. some Windows states) where Go's system pool loader fails; misconfigured SSL_CERT_FILE/SSL_CERT_DIR env vars pointing to unreadable paths.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

• failed to load server cert/key: %w
• failed to read ca cert: %w
• failed to create tls config: %w
• https server failed: %w
• unable to load system CA certificates: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ae4a55f12fae98a4. Report an issue: GitHub.