crowdsecurity/crowdsec · error

machine %s attempted to auth with TLS cert but it is configu

Error message

machine %s attempted to auth with TLS cert but it is configured to use %s

What it means

The machine exists in the database but its stored auth_type is not 'tls', so authenticating with an x509 certificate is refused. CrowdSec enforces one auth type per machine to prevent a password-registered agent from silently switching to cert auth.

Source

Thrown at pkg/apiserver/middlewares/v1/jwt.go:103

		pwd, err := GenerateAPIKey(dummyAPIKeySize)
		if err != nil {
			logger.WithField("cn", extractedCN).
				Errorf("error generating password: %s", err)

			return nil, errors.New("error generating password")
		}

		password := strfmt.Password(pwd)

		ret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, "", true, true, types.TlsAuthType)
		if err != nil {
			return nil, fmt.Errorf("while creating machine entry for %s: %w", ret.machineID, err)
		}
	} else if err != nil {
		return nil, fmt.Errorf("while selecting machine entry for %s: %w", ret.machineID, err)
	} else {
		if ret.clientMachine.AuthType != types.TlsAuthType {
			return nil, fmt.Errorf("machine %s attempted to auth with TLS cert but it is configured to use %s", ret.machineID, ret.clientMachine.AuthType)
		}

		ret.machineID = ret.clientMachine.MachineId
	}

	loginInput := struct {
		Scenarios []string `json:"scenarios"`
	}{
		Scenarios: []string{},
	}

	err = c.ShouldBindJSON(&loginInput)
	if err != nil {
		return nil, fmt.Errorf("missing scenarios list in login request for TLS auth: %w", err)
	}

	ret.scenariosInput = loginInput.Scenarios

View on GitHub (pinned to 909b515798)

Solutions

1. Delete the existing machine entry and re-enroll: cscli machines delete <machineID>, then re-register via TLS
2. Or update the auth type: cscli machines add <machineID> --auth-type tls (or update the DB row auth_type)
3. Align client configuration: either always use password auth (api client credentials) or always TLS certs for that machine
4. Check which auth flow your deployment tooling (ansible/terraform) registers agents with and make it consistent

Example fix

// before: machine registered with password, client switches to certs
// fix on LAPI host:
cscli machines delete myagent
cscli machines add myagent --auth-type tls --force

// check the machine's expected auth type before configuring TLS login
cscli machines list -o json | jq '.[] | select(.machineId=="myagent") | .authType'
// must output "tls" before using cert auth for that machine

_, err := client.LoginTLS(ctx)
if err != nil && strings.Contains(err.Error(), "configured to use") {
    return fmt.Errorf("machine registered with a different auth type; delete and re-enroll: %w", err)
}

When it happens

Trigger: Authenticator -> authTLS: SelectMachine returns the row and ret.clientMachine.AuthType != types.TlsAuthType (it is 'password'), meaning the machine was previously registered with 'cscli machines add' (password) and now logs in via mTLS cert.

Common situations: Operator registers an agent with a password, then switches it to cert-based auth without updating the DB row; mixed deployments where some agents use passwords and the same machine ID is reused; automation re-registering machines with a different method.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• while creating machine entry for %s: %w
• while selecting machine entry for %s: %w
• machine %s attempted to auth with password but it is configu
• failed to load api client certificate: %w
• unknown TLS client_verification value: %s

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4b8695094fc719ac. Report an issue: GitHub.