NationalSecurityAgency/ghidra · error · GeneralSecurityException

Path to certificate necessary to start server (--cert /path/

Error message

Path to certificate necessary to start server (--cert /path/to/cert)

What it means

Thrown by startCommand() when localAuthentication is PKI but certParameter (the `--cert` client certificate path) is null. PostgreSQL cert auth requires the client to present a certificate, so BSim refuses to start the server without the client cert path.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java:1011

	/**
	 * Start a PostgreSQL server, configured for BSim, on the local host.
	 * If the data directory is already populated, the server process is simply restarted.
	 * If the data directory is empty, a new server configuration is established, and the server is started.
	 * Authentication may be necessary, either via password or certificate, in order to enable
	 * the BSim extension on the server
	 * 
	 * @throws IOException if postgres cannot be started 
	 * @throws InterruptedException if the process fails during the run
	 * @throws SAXException if the data directory cannot be initialized
	 * @throws GeneralSecurityException if the authentication fails
	 */
	private void startCommand()
			throws IOException, InterruptedException, SAXException, GeneralSecurityException {
		discoverPostgresInstall();
		initializeDataDirectory();

		if (localAuthentication == AUTHENTICATION_PKI && certParameter == null) {
			throw new GeneralSecurityException(
				"Path to certificate necessary to start server (--cert /path/to/cert)");
		}
		File logFile = new File(dataDirectory, "logfile");
		List<String> command = new ArrayList<String>();
		command.add(postgresControl.getAbsolutePath());
		command.add("start");
		command.add("-w");
		command.add("-D");
		command.add(dataDirectory.getAbsolutePath());
		command.add("-l");
		command.add(logFile.getAbsolutePath());
		int res = runCommand(null, command, loadLibraryVar, loadLibraryValue);
		if (res != 0) {
			throw new IOException("Could not start postgres server process");
		}

		System.out.println("Server started");
		boolean extensionEnabled = true;

View on GitHub (pinned to d5f144c24d)

Solutions

1. Add `--cert /path/to/client.crt` to the start command.
2. Confirm the client certificate matches the CA in --cafile and the CN in --dn.
3. If local PKI is unwanted, pass `--noLocalAuth` so localAuthentication is downgraded.

Example fix

// before
bsim_ctl start --auth cert --cafile root.crt --dn "CN=bsim_admin" /var/bsim/data
// after
bsim_ctl start --auth cert --cafile root.crt --dn "CN=bsim_admin" --cert client.crt /var/bsim/data

boolean pkiLocal = "cert".equals(authMode) && !noLocalAuth;
if (pkiLocal && (certPath == null || certPath.isBlank())) {
    throw new IllegalArgumentException(
        "--cert <client.crt> is required for PKI local auth on start");
}

public boolean isStartPkiComplete(BsimCtlOptions o) {
    boolean pki = "cert".equals(o.auth);
    boolean localPki = pki && !o.noLocalAuth;
    return !localPki || (o.cert != null && new File(o.cert).isFile());
}

try {
    bsimControl.start(args);
} catch (GeneralSecurityException e) {
    if (e.getMessage() != null && e.getMessage().startsWith("Path to certificate necessary to start server")) {
        throw new UserFacingException("Add --cert <client.crt> for PKI start", e);
    }
    throw e;
}

When it happens

Trigger: Running `bsim_ctl start --auth cert ...` (which sets localAuthentication=PKI) without the global `--cert /path/to/client.crt` option.

Common situations: Operator supplies --cafile/--dn but forgets --cert; confuses server CA (--cafile) with client cert (--cert); running start with --noLocalAuth omitted so local PKI still applies.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• File {} does not appear to be a certificate
• PKI authentication requested, but certificate authority file
• {} is not a valid certification authority
• Distinguished name option (--dn) required for {}
• Distinguished name required (dn="..")

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/ac04de01722f06df. Report an issue: GitHub.