crowdsecurity/crowdsec · error

failed to register custom TLS config: %w

Error message

failed to register custom TLS config: %w

What it means

Connection dsn generation in pkg/csconfig registers a user-provided custom TLS configuration with the go-sql-driver/mysql driver via mysql.RegisterTLSConfig("custom", tlsConfig). The driver validates the *tls.Config (nil pointers in Certificates, invalid key pairs, etc.) and returns an error, which is wrapped here. Without a successfully registered TLS config the 'custom' TLS DSN parameter cannot resolve and the MySQL connection cannot be established securely.

Source

Thrown at pkg/csconfig/database.go:194

				return "", fmt.Errorf("failed to append CA cert file %s: %w", d.SSLCACert, err)
			}
			params.Set("tls", "custom")
		}

		if d.SSLClientCert != "" && d.SSLClientKey != "" {
			cert, err := tls.LoadX509KeyPair(d.SSLClientCert, d.SSLClientKey)
			if err != nil {
				return "", fmt.Errorf("failed to load client cert/key pair: %w", err)
			}
			tlsConfig.Certificates = []tls.Certificate{cert}
			params.Set("tls", "custom")
		}

		if params.Get("tls") == "custom" {
			// Register the custom TLS config
			err := mysql.RegisterTLSConfig("custom", tlsConfig)
			if err != nil {
				return "", fmt.Errorf("failed to register custom TLS config: %w", err)
			}
		}
		connString = fmt.Sprintf("%s?%s", connString, params.Encode())
	case "postgres", "postgresql", "pgx":
		if d.isSocketConfig() {
			connString = fmt.Sprintf("host=%s user=%s dbname=%s password=%s", d.DbPath, d.User, d.DbName, d.Password)
		} else {
			connString = fmt.Sprintf("host=%s port=%d user=%s dbname=%s password=%s", d.Host, d.Port, d.User, d.DbName, d.Password)
		}

		if d.SSLMode != "" {
			connString = fmt.Sprintf("%s sslmode=%s", connString, d.SSLMode)
		}

		if d.SSLCACert != "" {
			connString = fmt.Sprintf("%s sslrootcert=%s", connString, d.SSLCACert)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the CA cert, client cert and key files exist, are valid PEM, and the cert and key match (compare modulus or use `openssl x509 -noout -modulus` vs `openssl rsa -noout -modulus`).
2. If the private key is passphrase-protected, decrypt it first: `openssl rsa -in key.pem -out key-nopass.pem`.
3. Check the mysql/tls section of the database config for wrong paths and fix them.
4. If TLS is not actually needed, remove the tls=custom parameter rather than registering an incomplete config.

Example fix

// before (mismatched cert/key files in config)
// after
$ openssl x509 -noout -modulus -in client.crt | openssl md5
$ openssl rsa  -noout -modulus -in client.key | openssl md5
# fix the paths in /etc/crowdsec/local/database.yaml so both point to a matching pair

certPEM, err := os.ReadFile(cfg.CertPath)
if err != nil { return err }
keyPEM, err := os.ReadFile(cfg.KeyPath)
if err != nil { return err }
if _, err := tls.X509KeyPair(certPEM, keyPEM); err != nil {
    return fmt.Errorf("cert/key mismatch or invalid PEM: %w", err)
}

if _, err := NewClient(ctx, dbCfg); err != nil {
    var pathErr *fs.PathError
    if errors.As(err, &pathErr) || strings.Contains(err.Error(), "failed to register custom TLS config") {
        // fall back to non-custom TLS or surface a clear config error
    }
}

When it happens

Trigger: Database config has type mysql with tls=custom in the DSN params, and the built *tls.Config is invalid — e.g. CertPath/KeyPath point to mismatched or malformed PEM files so tls.X509KeyPair fails inside the driver's registration validation.

Common situations: Users set tls_discovery_cmd or custom CA/cert/key paths in crowdsec.db.yaml with typos, pass an encrypted private key, or provide a cert/key pair that does not match; the driver rejects the config at registration time before any connection is attempted.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to read CA cert file %s: %w
• failed to append CA cert file %s: %w
• failed to load client cert/key pair: %w
• allowed_ou configuration contains invalid empty string
• cannot use TLS with a unix socket

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/52e2f37d025f1024. Report an issue: GitHub.