crowdsecurity/crowdsec · error

while creating TLS config: %w

Error message

while creating TLS config: %w

What it means

APIServer.Run wraps the error from csconfig's TLS.GetTLSConfig(), which loads the certificate/key files and optional CRL/mTLS material for the LAPI HTTPS listener. The server never starts listening. The wrapped error names the actual file or parse problem.

Source

Thrown at pkg/apiserver/apiserver.go:335

	s.apic.metricsTomb.Go(func() error {
		defer trace.ReportPanic()
		s.apic.SendMetrics(ctx, make(chan bool))
		return nil
	})

	if !s.cfg.DisableUsageMetricsExport {
		s.apic.metricsTomb.Go(func() error {
			defer trace.ReportPanic()
			s.apic.SendUsageMetrics(ctx)
			return nil
		})
	}
}

func (s *APIServer) Run(ctx context.Context, apiReady chan bool) error {
	tlsCfg, err := s.cfg.TLS.GetTLSConfig()
	if err != nil {
		return fmt.Errorf("while creating TLS config: %w", err)
	}

	s.httpServer = &http.Server{
		Addr:      s.cfg.ListenURI,
		Handler:   s.router,
		TLSConfig: tlsCfg,
		Protocols: &http.Protocols{},
	}

	s.httpServer.Protocols.SetHTTP1(true)
	s.httpServer.Protocols.SetUnencryptedHTTP2(true)
	s.httpServer.Protocols.SetHTTP2(true)

	if s.apic != nil {
		s.initAPIC(ctx)
	}

	s.httpServerTomb.Go(func() error {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped cause: it names which file failed to load.
2. Verify tls.cert_file_path and tls.key_file_path exist and are readable by the crowdsec user.
3. Confirm the cert and key match: `openssl x509 -noout -modulus -in cert.pem | openssl md5` vs the key's.
4. Check validity: `openssl x509 -noout -dates -in cert.pem`.
5. If you don't want TLS on LAPI, remove the tls section from the api server config.

Example fix

// before
api:
  server:
    tls:
      cert_file_path: /etc/crowdsec/ssl/lapi.crt
      key_file_path: /etc/crowdsec/ssl/lapi.key
// after
api:
  server:
    tls:
      cert_file_path: /etc/crowdsec/ssl/lapi.pem
      key_file_path: /etc/crowdsec/ssl/lapi-key.pem

// pre-flight TLS material check
if cfg.TLS != nil {
    for _, f := range []string{cfg.TLS.CertFilePath, cfg.TLS.KeyFilePath} {
        if _, err := os.Stat(f); err != nil {
            return fmt.Errorf("TLS file %s missing: %w", f, err)
        }
    }
    if _, err := tls.LoadX509KeyPair(cfg.TLS.CertFilePath, cfg.TLS.KeyFilePath); err != nil {
        return fmt.Errorf("TLS pair invalid: %w", err)
    }
}

if err := apiServer.Run(ctx, ready); err != nil {
    if strings.Contains(err.Error(), "while creating TLS config") {
        log.Fatalf("fix TLS cert/key files: %v", err)
    }
    return err
}

When it happens

Trigger: Run called with a TLS-enabled LocalApiServerCfg where cert_file_path/key_file_path don't exist, are unreadable, the key doesn't match the cert, or the CRL is malformed.

Common situations: Cert path typo after moving config; cert renewed but key file replaced with wrong one; expired cert; unreadable files after permission change; bad CRL path.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• missing TLS key file
• missing TLS cert file
• missing TLS key file
• missing TLS cert file
• failed to load server cert/key: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/673e9b40ffa86dd2. Report an issue: GitHub.