crowdsecurity/crowdsec · error

while parsing bouncers cert auto-delete duration: %w

Error message

while parsing bouncers cert auto-delete duration: %w

What it means

StartFlushScheduler parses bouncers_gc.cert with cstime.ParseDurationWithDays to know when to delete stale bouncer certificate registrations. A parse failure produces this wrapped error and aborts startup.

Source

Thrown at pkg/database/flush.go:96

		if config.AgentsGC.LoginPassword != nil {
			duration, err := cstime.ParseDurationWithDays(*config.AgentsGC.LoginPassword)
			if err != nil {
				return nil, fmt.Errorf("while parsing agents login/password auto-delete duration: %w", err)
			}

			config.AgentsGC.LoginPasswordDuration = &duration
		}

		if config.AgentsGC.Api != nil {
			c.Log.Warning("agents auto-delete for API auth is not supported (use cert or login_password)")
		}
	}

	if config.BouncersGC != nil {
		if config.BouncersGC.Cert != nil {
			duration, err := cstime.ParseDurationWithDays(*config.BouncersGC.Cert)
			if err != nil {
				return nil, fmt.Errorf("while parsing bouncers cert auto-delete duration: %w", err)
			}

			config.BouncersGC.CertDuration = &duration
		}

		if config.BouncersGC.Api != nil {
			duration, err := cstime.ParseDurationWithDays(*config.BouncersGC.Api)
			if err != nil {
				return nil, fmt.Errorf("while parsing bouncers api auto-delete duration: %w", err)
			}

			config.BouncersGC.ApiDuration = &duration
		}

		if config.BouncersGC.LoginPassword != nil {
			c.Log.Warning("bouncers auto-delete for login/password auth is not supported (use cert or api)")
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Set a valid value such as cert: 30d or cert: 720h in config.yaml under bouncers_gc.
2. Convert unsupported units to days or Go durations before entering them.
3. Remove the cert key to skip bouncer cert GC.
4. Run a config validation/startup dry run to confirm the value parses before deploying to production.

Example fix

// before
bouncers_gc:
  cert: 6months

// after
bouncers_gc:
  cert: 180d

if cfg.BouncersGC != nil && cfg.BouncersGC.Cert != "" {
    if _, err := cstime.ParseDurationWithDays(cfg.BouncersGC.Cert); err != nil {
        return fmt.Errorf("bouncers_gc.cert: %w", err)
    }
}

if err != nil {
    if strings.Contains(err.Error(), "bouncers cert") {
        // reject/fix the bouncers_gc.cert value
    }
    return err
}

When it happens

Trigger: config.BouncersGC.Cert is set to a string ParseDurationWithDays rejects: missing unit, unsupported unit ('mo', 'y', 'w'), or invalid numeric format.

Common situations: Misconfigured api.server.gc.bouncers_gc.cert in config.yaml, e.g. cert: 6months or cert: 30 without a unit; copy-paste from non-crowdsec docs.

Understand the failure class

Background: "invalid duration" / "failed to parse duration": why your timeout, interval, or TTL string is rejected and which formats each library accepts — this error's family across 32 libraries.

Related errors

• while parsing agents cert auto-delete duration: %w
• while parsing agents login/password auto-delete duration: %w
• while parsing bouncers api auto-delete duration: %w
• empty cti key
• no listen_uri or listen_socket specified

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/0e7beaf0ca93d7e1. Report an issue: GitHub.