TechnitiumSoftware/DnsServer · error · ArgumentException

DNS Server TLS certificate file does not exists: {tlsCertifi

Error message

DNS Server TLS certificate file does not exists: {tlsCertificatePath}

What it means

Thrown by LoadDnsTlsCertificate when the FileInfo for tlsCertificatePath reports !Exists. The certificate path is checked before any PKCS#12 parsing, so the file must be present and readable on the server host.

Source

Thrown at DnsServerCore/Dns/DnsServer.cs:1564

                }, null, TLS_CERTIFICATE_UPDATE_TIMER_INITIAL_INTERVAL, TLS_CERTIFICATE_UPDATE_TIMER_INTERVAL);
            }
        }

        private void StopTlsCertificateUpdateTimer()
        {
            if (_tlsCertificateUpdateTimer is not null)
            {
                _tlsCertificateUpdateTimer.Dispose();
                _tlsCertificateUpdateTimer = null;
            }
        }

        private void LoadDnsTlsCertificate(string tlsCertificatePath, string tlsCertificatePassword)
        {
            FileInfo fileInfo = new FileInfo(tlsCertificatePath);

            if (!fileInfo.Exists)
                throw new ArgumentException("DNS Server TLS certificate file does not exists: " + tlsCertificatePath);

            switch (Path.GetExtension(tlsCertificatePath).ToLowerInvariant())
            {
                case ".pfx":
                case ".p12":
                    break;

                default:
                    throw new ArgumentException("DNS Server TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: " + tlsCertificatePath);
            }

            X509Certificate2Collection certificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(tlsCertificatePath, tlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);
            X509Certificate2 serverCertificate = null;

            foreach (X509Certificate2 certificate in certificateCollection)
            {
                if (certificate.HasPrivateKey)
                {

View on GitHub (pinned to d0484b6c1e)

Solutions

Confirm the cert file exists on the host running the DNS server (not the admin's machine): ls -l <path>.
Use an absolute path; the server converts via ConvertToAbsolutePath against its working directory.
In Docker, mount the certificate as a volume and reference the in-container path.
After renewal (certbot/acme), update SetDnsTlsCertificate to the new file or symlink a stable path.

Example fix

// before
server.SetDnsTlsCertificate("cert.pfx", pw);

// after
string certPath = Path.GetFullPath("/var/dns/certs/cert.pfx");
if (!File.Exists(certPath)) throw new FileNotFoundException(certPath);
server.SetDnsTlsCertificate(certPath, pw);

Defensive patterns

Strategy: validation

Validate before calling

string AbsoluteCertPath(string p)
{
    var full = Path.GetFullPath(p);
    if (!File.Exists(full)) throw new FileNotFoundException("TLS cert not found", full);
    return full;
}
// server.SetDnsTlsCertificate(AbsoluteCertPath(path), pass);

Type guard

static bool TlsCertFileExists(string path) => File.Exists(Path.GetFullPath(path));

Try / catch

try { server.SetDnsTlsCertificate(path, pass, throwException: true); }
catch (ArgumentException ex) when (ex.Message.Contains("does not exists")) { log.Error($"Cert file missing: {path}"); }

Prevention

Use absolute paths and confirm the file is on the server host.
In Docker, mount the cert as a volume and use the in-container path.
After renewal, update the path or use a stable symlink.

When it happens

Trigger: Calling SetDnsTlsCertificate(path, password) with a path that does not resolve on the server; relative path that resolves against the wrong working directory; certificate moved/deleted after a previous successful load; Docker volume not mounted.

Common situations: Path passed from the web UI but the file lives on the admin's workstation, not the server; Linux container without the cert volume; cert auto-renewed by certbot into a new path while the config still points at the old one; typos or unescaped spaces in the path.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/2b874edb6d7237c6. Report an issue: GitHub.