crowdsecurity/crowdsec · error

while creating machine entry for %s: %w

Error message

while creating machine entry for %s: %w

What it means

During TLS-certificate (mTLS) authentication, authTLS did not find the machine in the database and attempted to auto-create it (CreateMachine with TlsAuthType, validated=true); the DB write failed, so the whole TLS login is aborted with 'while creating machine entry for %s'.

Source

Thrown at pkg/apiserver/middlewares/v1/jwt.go:97

		Where(machine.MachineId(ret.machineID)).
		First(ctx)
	if ent.IsNotFound(err) {
		// Machine was not found, let's create it
		logger.Infof("machine %s not found, create it", ret.machineID)
		// let's use an apikey as the password, doesn't matter in this case (generatePassword is only available in cscli)
		pwd, err := GenerateAPIKey(dummyAPIKeySize)
		if err != nil {
			logger.WithField("cn", extractedCN).
				Errorf("error generating password: %s", err)

			return nil, errors.New("error generating password")
		}

		password := strfmt.Password(pwd)

		ret.clientMachine, err = j.DbClient.CreateMachine(ctx, &ret.machineID, &password, "", true, true, types.TlsAuthType)
		if err != nil {
			return nil, fmt.Errorf("while creating machine entry for %s: %w", ret.machineID, err)
		}
	} else if err != nil {
		return nil, fmt.Errorf("while selecting machine entry for %s: %w", ret.machineID, err)
	} else {
		if ret.clientMachine.AuthType != types.TlsAuthType {
			return nil, fmt.Errorf("machine %s attempted to auth with TLS cert but it is configured to use %s", ret.machineID, ret.clientMachine.AuthType)
		}

		ret.machineID = ret.clientMachine.MachineId
	}

	loginInput := struct {
		Scenarios []string `json:"scenarios"`
	}{
		Scenarios: []string{},
	}

	err = c.ShouldBindJSON(&loginInput)

View on GitHub (pinned to 909b515798)

Solutions

1. Check LAPI logs/database connectivity: is the DB reachable and writable (cscli machines list works locally)?
2. Run 'cscli migrate' / restart crowdsec to apply pending schema migrations
3. Pre-enroll the machine with 'cscli machines add <CN> --autoregister' or retry the client login (races resolve on retry)
4. Check disk space and DB user privileges if using PostgreSQL/MySQL

// verify DB connectivity before TLS enrollment
if err := db.PingContext(ctx); err != nil {
    return fmt.Errorf("database unreachable, machine auto-registration will fail: %w", err)
}

_, err := client.Login(ctx) // TLS watcher login
if err != nil && strings.Contains(err.Error(), "while creating machine entry") {
    log.Errorf("machine auto-registration failed, check LAPI database: %v", err)
    // pre-enroll from the LAPI host, then retry
}

When it happens

Trigger: Authenticator -> authTLS: a client presents a valid CA-signed cert whose CN is not yet a machines table row, and j.DbClient.CreateMachine returns an error — DB down, schema migration pending, unique-constraint race from concurrent first logins, or DB write permissions.

Common situations: First enrollment of a bouncer/agent via TLS while LAPI cannot reach the SQLite/PostgreSQL backend; two agents authenticating simultaneously for the first time; database left in a half-migrated state after an upgrade; disk full on the SQLite host.

Related errors

• while selecting machine entry for %s: %w
• machine %s attempted to auth with TLS cert but it is configu
• missing scenarios list in login request for TLS auth: %w
• tls authentication required
• certificate revoked by OCSP

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/953ec31db7f35902. Report an issue: GitHub.