crowdsecurity/crowdsec · error

missing TLS cert file

Error message

missing TLS cert file

What it means

Mirror of the key-file check: when either TLS path is set, both are required. A cert_file that is empty while key_file is present causes the server startup to abort with this error before ServeTLS is called.

Source

Thrown at pkg/acquisition/modules/appsec/run.go:37

	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
)

func (w *Source) listenAndServe(ctx context.Context, t *tomb.Tomb) error {
	w.logger.Infof("%d appsec runner to start", len(w.AppsecRunners))

	serverError := make(chan error, 2)

	startServer := func(listener net.Listener, canTLS bool) {
		var err error

		if canTLS && (w.config.CertFilePath != "" || w.config.KeyFilePath != "") {
			if w.config.KeyFilePath == "" {
				serverError <- errors.New("missing TLS key file")
				return
			}

			if w.config.CertFilePath == "" {
				serverError <- errors.New("missing TLS cert file")
				return
			}

			err = w.server.ServeTLS(listener, w.config.CertFilePath, w.config.KeyFilePath)
		} else {
			err = w.server.Serve(listener)
		}

		switch {
		case errors.Is(err, http.ErrServerClosed):
			break
		case err != nil:
			serverError <- err
		}
	}

	listenConfig := &net.ListenConfig{}

View on GitHub (pinned to 909b515798)

Solutions

1. Add the cert_file path alongside key_file in the config
2. Confirm the certificate file exists and is readable by the crowdsec process
3. Remove both cert_file and key_file to intentionally run plain HTTP

Example fix

// before
source: appsec
 key_file: /etc/ssl/crowdsec/tls.key
// after
source: appsec
 cert_file: /etc/ssl/crowdsec/tls.cert
 key_file: /etc/ssl/crowdsec/tls.key

if (cfg.CertFilePath != "" || cfg.KeyFilePath != "") && cfg.CertFilePath == "" {
    return errors.New("key_file set without cert_file")
}

go func() {
    if err := <-serverError; err != nil {
        if strings.Contains(err.Error(), "missing TLS cert") { /* fix cert/key pair in config */ }
    }
}()

When it happens

Trigger: startServer runs with w.config.KeyFilePath set but w.config.CertFilePath empty — key_file given without cert_file in the appsec datasource config.

Common situations: Configuring TLS on the appsec listener and providing only the key; typoed cert_file key; certificate file removed by secret rotation while key remained.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• missing TLS key file
• while creating TLS config: %w
• missing lapi client credentials
• no appsec_config provided
• missing TLS key file

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b323906ed1b58cfe. Report an issue: GitHub.