What causes "server_cert is required" in crowdsecurity/crowdsec?

Add server_cert under the tls block with the path to the server's PEM certificate

server_cert is required

Error message

server_cert is required

What it means

A tls block was provided in the http source config, but server_cert is empty. Whenever TLS is configured (c.TLS != nil), Validate() requires both a server certificate and key so the HTTPS listener can present itself to clients. The error is returned before the cert file is ever loaded.

Source

Thrown at pkg/acquisition/modules/http/config.go:131

		if c.BasicAuth.Password == "" {
			return errors.New(baseErr + " password is not provided")
		}
	case "headers":
		if c.Headers == nil {
			return errors.New("headers is selected, but headers is not provided")
		}
	case "mtls":
		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	/*
		if hc.ChunkSize != nil && *hc.ChunkSize <= 0 {
			return errors.New("chunk_size must be positive")
		}
	*/

	if c.CustomStatusCode != nil {

View on GitHub (pinned to 909b515798)

Solutions

Add server_cert under the tls block with the path to the server's PEM certificate
Add server_key too — validation will demand it next if only server_cert is set
If no TLS is intended at all, remove the tls block (note: auth_type mtls and HTTPS require TLS, so you cannot drop it in that case)
Confirm the key name is exactly server_cert and it is indented under tls:

Example fix

# before
source: http
listen_addr: 127.0.0.1:8080
auth_type: mtls
tls:
  ca_cert: /etc/ssl/client-ca.crt
# after
source: http
listen_addr: 127.0.0.1:8080
auth_type: mtls
tls:
  server_cert: /etc/ssl/server.crt
  server_key: /etc/ssl/server.key
  ca_cert: /etc/ssl/client-ca.crt

Defensive patterns

Strategy: validation

Validate before calling

if cfg.TLS != nil && cfg.TLS.ServerCert == "" {
    return errors.New("tls block present but server_cert is missing")
}

Type guard

func tlsComplete(c *httpacquisition.TLSConfig) bool {
    return c != nil && c.ServerCert != "" && c.ServerKey != ""
}

Try / catch

if err := src.Configure(ctx, yamlCfg, logger, metricsLevel); err != nil {
    if strings.Contains(err.Error(), "server_cert is required") {
        logger.Error("http source: tls configured without server_cert")
    }
    return err
}

Prevention

Never emit an empty/partial tls: block from templates — omit it entirely if TLS is unused
When enabling mtls, provision all of server_cert, server_key and ca_cert together
Test config load in a staging environment before production rollout

When it happens

Trigger: YAML sets tls: with only ca_cert (e.g. when using auth_type: mtls the user put ca_cert but no server_cert/server_key), or an empty tls: {} block, or server_cert key misspelled/omitted. Raised by Configuration.Validate() (config.go:129-132).

Common situations: mTLS users who add ca_cert for client verification but forget the server's own certificate; configs where tls is present but mostly empty; copy-paste examples that only show the CA path; strict-mode YAML typos resolved by omission.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/16696f447051cb1a. Report an issue: GitHub.