TechnitiumSoftware/DnsServer · error · ArgumentException

Web server '{_name}' TLS certificate file does not exists: {

Error message

Web server '{_name}' TLS certificate file does not exists: {webServerTlsCertificateFilePath}

What it means

Thrown by BlockPageApp LoadWebServiceTlsCertificate when the configured 'webServerTlsCertificateFilePath' does not exist on disk (FileInfo.Exists is false). ArgumentException is raised before any certificate parsing, so the web server cannot start TLS.

Source

Thrown at Apps/BlockPageApp/App.cs:469

                    _dnsServer.WriteLog(ex);
                }
            }

            private async Task StopWebServerAsync()
            {
                if (_webServer is not null)
                {
                    await _webServer.DisposeAsync();
                    _webServer = null;
                }
            }

            private void LoadWebServiceTlsCertificate(string webServerTlsCertificateFilePath, string? webServerTlsCertificatePassword)
            {
                FileInfo fileInfo = new FileInfo(webServerTlsCertificateFilePath);

                if (!fileInfo.Exists)
                    throw new ArgumentException("Web server '" + _name + "' TLS certificate file does not exists: " + webServerTlsCertificateFilePath);

                switch (Path.GetExtension(webServerTlsCertificateFilePath).ToLowerInvariant())
                {
                    case ".pfx":
                    case ".p12":
                        break;

                    default:
                        throw new ArgumentException("Web server '" + _name + "' TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: " + webServerTlsCertificateFilePath);
                }

                X509Certificate2Collection webServerTlsCertificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(webServerTlsCertificateFilePath, webServerTlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);
                X509Certificate2? serverCertificate = null;

                foreach (X509Certificate2 certificate in webServerTlsCertificateCollection)
                {
                    if (certificate.HasPrivateKey)
                    {

View on GitHub (pinned to d0484b6c1e)

Solutions

Verify the path in 'webServerTlsCertificateFilePath' exists and is readable by the DNS server service account.
Use an absolute path to the .pfx/.p12 file to avoid working-directory ambiguity.
In containers, ensure the certificate file is mounted/copied into the image or volume and the path matches.

Example fix

// before (dnsApp.config)
"webServerTlsCertificateFilePath": "cert.pfx"
// after
"webServerTlsCertificateFilePath": "/etc/technitium/certs/blockpage.pfx"

Defensive patterns

Strategy: validation

Validate before calling

if (!File.Exists(webServerTlsCertificateFilePath))
    throw new FileNotFoundException($"TLS certificate file not found: {webServerTlsCertificateFilePath}");
if (!new FileInfo(webServerTlsCertificateFilePath).Exists)
    throw new UnauthorizedAccessException($"TLS certificate file not readable by service account: {webServerTlsCertificateFilePath}");

Prevention

Use absolute paths for the certificate file.
Ensure the service account has read permission on the file.
In containers, mount the cert volume and reference the mounted path.

When it happens

Trigger: Calling web server initialization with a TLS certificate path that points to a missing file: wrong path, file deleted, relative path resolved against an unexpected working directory, or the cert was never placed.

Common situations: Path typo; cert stored under a different user/home so the service account cannot see it (permissions read as missing); container deployment that forgot to mount the cert volume; moving the config between machines.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/44bd19825694706d. Report an issue: GitHub.