BeyondDimension/SteamTools · error · ApplicationException

Could not remove certificate as it is null or empty.

Error message

Could not remove certificate as it is null or empty.

What it means

Thrown by SharedRemoveTrustedRootCertificate when RootCertificate is null while attempting to remove the root cert from the LocalMachine Root store. Removal needs the in-memory certificate object (or at least that it was loaded); if nothing was loaded the uninstall step cannot proceed safely.

Source

Thrown at src/BD.WTTS.Client.Plugins.Accelerator.ReverseProxy/Services.Implementation/Certificate/CertificateManagerImpl.cs:159

        //var rootCertificateName = CertificateConstants.RootCertificateName;

        RootCertificate = CertGenerator.GenerateBySelfPfx(
            null,
            validFrom,
            validTo,
            Interface.PfxFilePath,
            GetPfxPassword());
        RootCertificatePackable = X509CertificatePackable.CreateX509Certificate2(Interface.PfxFilePath, GetPfxPassword(), X509KeyStorageFlags.Exportable);

        return RootCertificate != null;
    }

    void SharedRemoveTrustedRootCertificate()
    {
        if (RootCertificate == null)
        {
            throw new ApplicationException(
                "Could not remove certificate as it is null or empty.");
        }

        using var x509Store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);

        try
        {
            x509Store.Open(OpenFlags.ReadWrite);
            foreach (var item in x509Store.Certificates.Find(X509FindType.FindBySubjectName, CertificateConstants.RootCertificateName, false))
            {
                //if (item.Thumbprint == RootCertificate.Thumbprint)
                //{
                x509Store.Remove(item);
                //}
            }
            //x509Store.Remove(RootCertificate);
        }
        catch (Exception e)

View on GitHub (pinned to c16ffa08e0)

Solutions

1. Load or regenerate RootCertificate before calling remove, or skip removal when it is already null.
2. If the cert is already gone from the store, treat null as a no-op success instead of throwing.
3. Restore the PFX from backup (with correct password) so it can be loaded for removal.
4. Guard the remove call with a null check and log a warning rather than aborting cleanup.

Example fix

// before
SharedRemoveTrustedRootCertificate(); // throws if RootCertificate == null

// after
if (RootCertificate == null)
{
    Log.Warning(TAG, "RootCertificate null; nothing to remove.");
    return;
}
SharedRemoveTrustedRootCertificate();

// Treat a missing cert as a no-op during cleanup instead of throwing.
if (certificateManager.RootCertificate == null)
{
    Log.Warning(TAG, "RootCertificate is null; skipping removal (already gone).");
    return;
}
certificateManager.SharedRemoveTrustedRootCertificate();

bool CanRemoveCertificate(ICertificateManager mgr) => mgr.RootCertificate != null;

try { certificateManager.SharedRemoveTrustedRootCertificate(); }
catch (ApplicationException ex) when (ex.Message.Contains("null or empty"))
{
    Log.Information(TAG, "No loaded certificate to remove; uninstall proceeding.");
    // cleanup is effectively already done
}

When it happens

Trigger: Calling the remove path when RootCertificate was never loaded — e.g. during uninstall/cleanup on a system where the PFX was already deleted, generation never ran, or a prior load failed and returned null.

Common situations: User deleted the PFX manually before uninstalling; cleanup runs after a failed install that never produced a cert; profile/cert store reset left the app with no loaded cert; calling remove on a fresh install that never trusted anything.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Could not install certificate as it is null or empty.
• 5

AI-assisted analysis of BeyondDimension/SteamTools@c16ffa08e0 (2026-08-13). Data as JSON: /api/errors/a3135ded5a700b11. Report an issue: GitHub.