BeyondDimension/SteamTools · error · ApplicationException

Could not install certificate as it is null or empty.

Error message

Could not install certificate as it is null or empty.

What it means

Thrown by the obsolete SharedTrustRootCertificate path when RootCertificate is null at the moment it tries to install the root cert into the Windows LocalMachine Root store. A null RootCertificate means the in-memory certificate object was never populated (load/generate failed or was skipped) before the trust step ran.

Source

Thrown at src/BD.WTTS.Client.Plugins.Accelerator.ReverseProxy/Services.Implementation/Certificate/CertificateManagerImpl.cs:96

            {
                Log.Error(TAG, "Loaded root certificate has expired.");
                return null;
            }
            return rootCert;
        }
        catch (Exception ex)
        {
            Log.Error(TAG, ex, nameof(LoadRootCertificate));
            return null;
        }
    }

    [Obsolete("use ICertificateManager.Constants.TrustRootCertificate")]
    void SharedTrustRootCertificate()
    {
        if (RootCertificate == null)
        {
            throw new ApplicationException(
                "Could not install certificate as it is null or empty.");
        }

        using var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);
        try
        {
            store.Open(OpenFlags.ReadWrite);

            //var subjectName = RootCertificate.Subject[3..];
            //foreach (var item in store.Certificates.Find(X509FindType.FindBySubjectName, subjectName, false))
            //{
            //    if (item.Thumbprint != RootCertificate.Thumbprint)
            //    {
            //        store.Remove(item);
            //    }
            //}

            if (store.Certificates.Find(X509FindType.FindByThumbprint, RootCertificate.Thumbprint, true).Count == 0)

View on GitHub (pinned to c16ffa08e0)

Solutions

1. Call GenerateCertificate() first and confirm RootCertificate is non-null before trusting.
2. Verify Interface.PfxFilePath exists and GetPfxPassword() returns the correct password.
3. Delete any half-written PFX so generation recreates it cleanly, then retry.
4. Migrate off the obsolete method to ICertificateManager.Constants.TrustRootCertificate.

Example fix

// before
SharedTrustRootCertificate(); // RootCertificate may be null

// after
if (RootCertificate == null) GenerateCertificate();
if (RootCertificate == null)
    throw new InvalidOperationException("Certificate generation failed; cannot trust.");
ICertificateManager.Constants.TrustRootCertificate(GetCerFilePathGeneratedWhenNoFileExists, platformService, RootCertificate);

// Ensure the cert is loaded/generated before trusting.
if (certificateManager.RootCertificate == null)
    certificateManager.GenerateCertificate();
if (certificateManager.RootCertificate == null)
    throw new InvalidOperationException(
        $"Cannot trust root cert; PFX missing at {pfxFilePath} or password invalid.");
certificateManager.TrustRootCertificate();

bool HasRootCertificate(ICertificateManager mgr) => mgr.RootCertificate != null;

try { certificateManager.SharedTrustRootCertificate(); }
catch (ApplicationException ex) when (ex.Message.Contains("null or empty"))
{
    Log.Error(TAG, ex, "RootCertificate was null at trust time; attempting regeneration.");
    certificateManager.GenerateCertificate();
    certificateManager.TrustRootCertificate(); // uses the non-obsolete path
}

When it happens

Trigger: Calling SharedTrustRootCertificate (directly or via legacy code paths) before LoadRootCertificate/GenerateCertificate has populated RootCertificate, or after those returned null due to a missing/corrupt PFX or wrong password.

Common situations: PFX file missing or deleted; PFX password changed or not supplied; certificate generation threw and was swallowed earlier; first-run on a fresh profile where generation failed silently; calling the obsolete method instead of ICertificateManager.Constants.TrustRootCertificate.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Could not remove certificate as it is null or empty.
• 5
• TCP port {httpProxyPort} is already occupied by other proces
• Failed to get available ports. There are no available ports.

AI-assisted analysis of BeyondDimension/SteamTools@c16ffa08e0 (2026-08-13). Data as JSON: /api/errors/857f88795bd74681. Report an issue: GitHub.