crowdsecurity/crowdsec · error

unable to load system CA certificates: %w

Error message

unable to load system CA certificates: %w

What it means

Returned by Configuration.NewTLSConfig when x509.SystemCertPool() fails while building TLS settings for the kafka dialer. SystemCertPool reads the OS trust store, so this indicates the system CA bundle is unavailable or unreadable in the environment. The error is wrapped with the underlying cause (%w).

Source

Thrown at pkg/acquisition/modules/kafka/config.go:121

	tlsConfig := tls.Config{
		InsecureSkipVerify: c.TLS.InsecureSkipVerify,
	}

	cert, err := tls.LoadX509KeyPair(c.TLS.ClientCert, c.TLS.ClientKey)
	if err != nil {
		return &tlsConfig, err
	}

	tlsConfig.Certificates = []tls.Certificate{cert}

	caCert, err := os.ReadFile(c.TLS.CaCert)
	if err != nil {
		return &tlsConfig, err
	}

	caCertPool, err := x509.SystemCertPool()
	if err != nil {
		return &tlsConfig, fmt.Errorf("unable to load system CA certificates: %w", err)
	}

	if caCertPool == nil {
		caCertPool = x509.NewCertPool()
	}

	caCertPool.AppendCertsFromPEM(caCert)
	tlsConfig.RootCAs = caCertPool

	return &tlsConfig, err
}

func (c *Configuration) NewDialer() (*kafka.Dialer, error) {
	dialer := &kafka.Dialer{}
	timeoutDuration := time.Duration(10) * time.Second

	if c.Timeout != "" {
		intTimeout, err := strconv.Atoi(c.Timeout)

View on GitHub (pinned to 909b515798)

Solutions

1. Install the CA bundle in the image: `apk add ca-certificates` (alpine) or `apt-get install -y ca-certificates` (debian)
2. Verify /etc/ssl/certs/ca-certificates.crt exists and is readable
3. As a workaround in degraded environments, note the code falls back to an empty pool only when SystemCertPool returns nil without error — an actual error must still be fixed at the OS level
4. Check the wrapped %w error text to confirm the platform-specific cause

Example fix

// Dockerfile before
FROM golang:1.xx-alpine
// after
FROM golang:1.xx-alpine
RUN apk add --no-cache ca-certificates

// guard at container/image build time
// RUN test -r /etc/ssl/certs/ca-certificates.crt || (apk add ca-certificates)

tlsCfg, err := cfg.NewTLSConfig()
if err != nil {
    var sysErr error
    if errors.As(err, &sysErr) && strings.Contains(err.Error(), "system CA") {
        logger.Warn("install ca-certificates in the image")
    }
    return err
}

When it happens

Trigger: A kafka datasource with a `tls:` block set triggers NewTLSConfig; x509.SystemCertPool() errors when the platform trust store cannot be located/read — typically a slim/alpine or scratch container missing ca-certificates, or a Windows host where it is unsupported.

Common situations: Running crowdsec in a distroless/scratch/alpine image without the ca-certificates package; minimal container images built from scratch; stripped-down appliance OSes.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• failed to load server cert/key: %w
• failed to read ca cert: %w
• failed to load system cert pool: %w
• cannot create %s dialer: %w
• client certificate OU %v doesn't match expected OU %v

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c78b4b7ea662fc58. Report an issue: GitHub.