What causes "while creating TLS auth for agents: %w" in crowdsecurity/crowdsec?

Check tls.crl_path exists and is a valid x509 CRL (`openssl crl -in crl.pem -noout -text`).

while creating TLS auth for agents: %w

Error message

while creating TLS auth for agents: %w

What it means

InitController wraps the error from v1.NewTLSAuth when building the agent-side mTLS authentication middleware. NewTLSAuth parses the CA/CRL and validates the allowed agents OU against the presented certificates, so failures are certificate-material problems.

Source

Thrown at pkg/apiserver/apiserver.go:569

	if s.cfg.TLS == nil {
		return nil
	}

	// TLS is configured: create the TLSAuth middleware for agents and bouncers

	cacheExpiration := time.Hour
	if s.cfg.TLS.CacheExpiration != nil {
		cacheExpiration = *s.cfg.TLS.CacheExpiration
	}

	s.controller.HandlerV1.Middlewares.JWT.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedAgentsOU, s.cfg.TLS.CRLPath,
		cacheExpiration,
		log.WithFields(log.Fields{
			"component": "tls-auth",
			"type":      "agent",
		}))
	if err != nil {
		return fmt.Errorf("while creating TLS auth for agents: %w", err)
	}

	s.controller.HandlerV1.Middlewares.APIKey.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedBouncersOU, s.cfg.TLS.CRLPath,
		cacheExpiration,
		log.WithFields(log.Fields{
			"component": "tls-auth",
			"type":      "bouncer",
		}))
	if err != nil {
		return fmt.Errorf("while creating TLS auth for bouncers: %w", err)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Check tls.crl_path exists and is a valid x509 CRL (`openssl crl -in crl.pem -noout -text`).
Verify the CA cert used for mTLS loads: `openssl x509 -in ca.pem -noout`.
If you don't use CRLs, remove crl_path from the TLS config.
Regenerate the CRL after the CA changed (stale/mismatched CA-CRL pair).

Example fix

// before
api:
  server:
    tls:
      crl_path: /etc/crowdsec/ssl/missing.crl
// after
api:
  server:
    tls:
      crl_path: /etc/crowdsec/ssl/ca.crl

Defensive patterns

Strategy: validation

Validate before calling

// pre-flight before InitController with TLS
if cfg.TLS != nil && cfg.TLS.CRLPath != "" {
    data, err := os.ReadFile(cfg.TLS.CRLPath)
    if err != nil {
        return fmt.Errorf("CRL %s unreadable: %w", cfg.TLS.CRLPath, err)
    }
    if _, err := x509.ParseRevocationList(data); err != nil {
        return fmt.Errorf("CRL %s invalid: %w", cfg.TLS.CRLPath, err)
    }
}

Try / catch

if err := server.InitController(); err != nil {
    if strings.Contains(err.Error(), "TLS auth for agents") {
        log.Fatalf("agent mTLS material invalid: %v", err)
    }
    return err
}

Prevention

Provision CRL and CA together whenever you rotate the CA.
Verify CRL files with openssl before deploying.
Only set crl_path when you actually publish a CRL.
Automate CRL freshness checks (expired CRLs break mTLS auth).

When it happens

Trigger: InitController called with a TLS config where the CRL file (tls.crl_path) is missing/unparseable or the CA chain cannot be loaded for the agents TLS-auth middleware.

Common situations: crl_path set to a non-existent file; CRL in wrong format (must be PEM/DER x509); CA bundle path wrong; misconfigured allowed_agents_ou combined with bad cert material.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/53476f9557037aa1. Report an issue: GitHub.