What causes "while creating TLS auth for bouncers: %w" in crowdsecurity/crowdsec?

Verify the CA/CRL pair for bouncers loads: `openssl crl -in crl.pem -noout -text`.

while creating TLS auth for bouncers: %w

Error message

while creating TLS auth for bouncers: %w

What it means

Constructing the TLS-auth middleware for bouncers (v1.NewTLSAuth with AllowedBouncersOU, CRLPath and cache expiration) failed during LAPI controller initialization. The agent TLS-auth middleware was built just before with the same code path, so a failure here typically stems from bouncer-specific OU/CRL configuration — e.g. an unreadable or malformed CRL file.

Source

Thrown at pkg/apiserver/apiserver.go:579

	s.controller.HandlerV1.Middlewares.JWT.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedAgentsOU, s.cfg.TLS.CRLPath,
		cacheExpiration,
		log.WithFields(log.Fields{
			"component": "tls-auth",
			"type":      "agent",
		}))
	if err != nil {
		return fmt.Errorf("while creating TLS auth for agents: %w", err)
	}

	s.controller.HandlerV1.Middlewares.APIKey.TlsAuth, err = v1.NewTLSAuth(s.cfg.TLS.AllowedBouncersOU, s.cfg.TLS.CRLPath,
		cacheExpiration,
		log.WithFields(log.Fields{
			"component": "tls-auth",
			"type":      "bouncer",
		}))
	if err != nil {
		return fmt.Errorf("while creating TLS auth for bouncers: %w", err)
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

Verify the CA/CRL pair for bouncers loads: `openssl crl -in crl.pem -noout -text`.
Ensure tls.crl_path is readable and covers bouncer certificates.
Confirm tls.allowed_bouncers_ou matches the OU actually present in bouncer certs.
Regenerate and redistribute the CRL if the CA was rotated.

Example fix

// before
tls:
  crl_path: /etc/crowdsec/ssl/agents-only.crl
// after
tls:
  crl_path: /etc/crowdsec/ssl/all-clients.crl

Defensive patterns

Strategy: validation

Validate before calling

// pre-flight bouncer mTLS material
if cfg.TLS != nil {
    if cfg.TLS.AllowedBouncersOU != "" && cfg.TLS.CRLPath != "" {
        if err := validateCRLForCA(cfg.TLS.CRLPath, bouncerCA); err != nil {
            return fmt.Errorf("bouncer CRL/CA mismatch: %w", err)
        }
    }
}

Try / catch

if err := server.InitController(); err != nil {
    if strings.Contains(err.Error(), "TLS auth for bouncers") {
        log.Fatalf("bouncer mTLS material invalid: %v", err)
    }
    return err
}

Prevention

Use one CRL covering both agent and bouncer certs, or split paths correctly.
Verify bouncer certs carry the OU listed in allowed_bouncers_ou.
Rotate bouncer CA and CRL in the same deployment step.
Test a bouncer mTLS handshake after any cert infrastructure change.

When it happens

Trigger: InitController called with TLS enabled where the CRL or CA material required for bouncer certificate validation is missing or invalid (allowed_bouncers_ou path).

Common situations: Bouncers on mTLS setups: crl_path points to an agent-only CRL; separate CA for bouncers not deployed; expired CRL revoked material parsing failure.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6a58564822964c13. Report an issue: GitHub.