crowdsecurity/crowdsec · error

mtls is selected, but ca_cert is not provided

Error message

mtls is selected, but ca_cert is not provided

What it means

The HTTP acquisition source config selected auth_type "mtls" (mutual TLS), but the client CA certificate path is missing. When mtls is chosen, the server must load a CA cert (tls.ca_cert) to verify client certificates; Validate() rejects the config if c.TLS is nil or c.TLS.CaCert is empty. This is a config-time validation error raised when loading an acquisition YAML file.

Source

Thrown at pkg/acquisition/modules/http/config.go:123

		baseErr := "basic_auth is selected, but"
		if c.BasicAuth == nil {
			return errors.New(baseErr + " basic_auth is not provided")
		}

		if c.BasicAuth.Username == "" {
			return errors.New(baseErr + " username is not provided")
		}

		if c.BasicAuth.Password == "" {
			return errors.New(baseErr + " password is not provided")
		}
	case "headers":
		if c.Headers == nil {
			return errors.New("headers is selected, but headers is not provided")
		}
	case "mtls":
		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a ca_cert entry under the tls block pointing to the PEM CA file used to sign/verify client certificates
2. If you do not actually need client-certificate authentication, change auth_type to basic_auth or headers
3. Verify the ca_cert key is correctly indented inside the tls: block and the YAML has no typos
4. Check that c.TLS itself is provided (a tls block with at least server_cert/server_key is required alongside ca_cert)

Example fix

# before
source: http
listen_addr: 127.0.0.1:8080
auth_type: mtls
tls:
  server_cert: /etc/ssl/server.crt
  server_key: /etc/ssl/server.key
# after
source: http
listen_addr: 127.0.0.1:8080
auth_type: mtls
tls:
  server_cert: /etc/ssl/server.crt
  server_key: /etc/ssl/server.key
  ca_cert: /etc/ssl/client-ca.crt

if cfg.AuthType == "mtls" && (cfg.TLS == nil || cfg.TLS.CaCert == "") {
    return errors.New("auth_type mtls requires tls.ca_cert to be set")
}

func mtlsConfigValid(c httpacquisition.Configuration) bool {
    return c.AuthType != "mtls" || (c.TLS != nil && c.TLS.CaCert != "")
}

if err := src.Configure(ctx, yamlCfg, logger, metricsLevel); err != nil {
    if strings.Contains(err.Error(), "ca_cert is not provided") {
        logger.Errorf("mtls acquisition config incomplete: %v", err)
    }
    return err
}

When it happens

Trigger: A YAML acquisition file for the http source sets auth_type: mtls but omits the tls block entirely, or sets tls: with server_cert/server_key but no ca_cert (or ca_cert: ""). Configuration.Validate() (pkg/acquisition/modules/http/config.go:121-124) returns this error during Configure/UnmarshalConfig.

Common situations: Users copy an HTTPS listener example that only has server_cert/server_key and add auth_type: mtls without realizing the CA used to sign client certs must also be configured; indentation mistakes put ca_cert outside the tls block; strict YAML parsing silently maps ca_cert to nothing due to a typo (strict mode would actually flag unknown keys, so more often it's plain omission).

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• invalid auth_type: must be one of basic_auth, headers, mtls
• server_cert is required
• server_key is required
• max_body_size must be positive
• invalid threshold: must be > 0 and <= 1

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/7b8b3dfcf505bc1e. Report an issue: GitHub.