crowdsecurity/crowdsec · error

https server failed: %w

Error message

https server failed: %w

What it means

When the datasource is configured with a listen socket, RunServer calls ServeTLS on the prepared listener; any serve error other than the normal http.ErrServerClosed shutdown is wrapped as this error and aborts acquisition startup.

Source

Thrown at pkg/acquisition/modules/http/run.go:253

	t.Go(func() error {
		defer trace.ReportPanic()

		if s.Config.ListenSocket == "" {
			return nil
		}

		s.logger.Infof("creating unix socket on %s", s.Config.ListenSocket)
		_ = os.Remove(s.Config.ListenSocket)

		listener, err := listenConfig.Listen(ctx, "unix", s.Config.ListenSocket)
		if err != nil {
			return csnet.WrapSockErr(err, s.Config.ListenSocket)
		}

		if s.Config.TLS != nil {
			err := s.Server.ServeTLS(listener, s.Config.TLS.ServerCert, s.Config.TLS.ServerKey)
			if err != nil && err != http.ErrServerClosed {
				return fmt.Errorf("https server failed: %w", err)
			}
		} else {
			err := s.Server.Serve(listener)
			if err != nil && err != http.ErrServerClosed {
				return fmt.Errorf("http server failed: %w", err)
			}
		}

		return nil
	})

	t.Go(func() error {
		defer trace.ReportPanic()

		if s.Config.ListenAddr == "" {
			return nil
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Verify server_cert and server_key paths exist and are readable; check with openssl x509/x509 in -noout.
2. Confirm the cert's public key matches the private key (compare modulus or use openssl pkey -pubout).
3. Renew expired certificates.
4. Check for the wrapped inner error (e.g. 'open ...: no such file') to identify which file is wrong.

Example fix

# before
server_cert: /etc/crowdsec/ssl/old.crt  # expired
# after
server_cert: /etc/crowdsec/ssl/renewed.crt
server_key: /etc/crowdsec/ssl/renewed.key

if _, err := tls.LoadX509KeyPair(cert, key); err != nil { return fmt.Errorf("cert/key invalid: %w", err) }

err := startServer(); if err != nil && !errors.Is(err, http.ErrServerClosed) { log.Fatalf("https server: %v", err) }

When it happens

Trigger: TLS-enabled datasource using listen_socket; http.Server.ServeTLS fails because the server certificate/key files are missing, invalid, mismatched, or the TLS handshake setup fails.

Common situations: Wrong or expired server cert paths (server_cert/server_key); cert and key do not match; key file has permissions denied to the crowdsec user; cert not PEM-encoded.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• failed to load server cert/key: %w
• failed to read ca cert: %w
• failed to load system cert pool: %w
• failed to create tls config: %w
• http server failed: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ede5358682092841. Report an issue: GitHub.