TechnitiumSoftware/DnsServer · error · ArgumentException

Web Service TLS certificate file does not exists: {tlsCertif

Error message

Web Service TLS certificate file does not exists: {tlsCertificatePath}

What it means

ArgumentException thrown by LoadWebServiceTlsCertificate when FileInfo.Exists is false for the supplied TLS certificate path. The loader refuses to proceed because there is no file to read the PFX/P12 from.

Source

Thrown at DnsServerCore/DnsWebService.cs:2685

                }, null, TLS_CERTIFICATE_UPDATE_TIMER_INITIAL_INTERVAL, TLS_CERTIFICATE_UPDATE_TIMER_INTERVAL);
            }
        }

        private void StopTlsCertificateUpdateTimer()
        {
            if (_tlsCertificateUpdateTimer is not null)
            {
                _tlsCertificateUpdateTimer.Dispose();
                _tlsCertificateUpdateTimer = null;
            }
        }

        private void LoadWebServiceTlsCertificate(string tlsCertificatePath, string tlsCertificatePassword)
        {
            FileInfo fileInfo = new FileInfo(tlsCertificatePath);

            if (!fileInfo.Exists)
                throw new ArgumentException("Web Service TLS certificate file does not exists: " + tlsCertificatePath);

            switch (Path.GetExtension(tlsCertificatePath).ToLowerInvariant())
            {
                case ".pfx":
                case ".p12":
                    break;

                default:
                    throw new ArgumentException("Web Service TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: " + tlsCertificatePath);
            }

            X509Certificate2Collection certificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(tlsCertificatePath, tlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);
            X509Certificate2 serverCertificate = null;

            foreach (X509Certificate2 certificate in certificateCollection)
            {
                if (certificate.HasPrivateKey)
                {

View on GitHub (pinned to d0484b6c1e)

Solutions

Verify the path exists and is readable by the service account (check the absolute path after ConvertToAbsolutePath).
Place the .pfx/.p12 in the configured certificate folder and update the config to point at it.
For containers, ensure the certificate volume/file is mounted at the expected path.
Grant the service account read permission on the certificate file.

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

string absPath = Path.GetFullPath(webServiceTlsCertificatePath);
if (!File.Exists(absPath))
    throw new FileNotFoundException("TLS certificate file not found.", absPath);
_dnsWebService.SetWebServiceTlsCertificate(absPath, password);

Type guard

static bool CertificateFileExists(string path) => File.Exists(path);

Try / catch

catch (ArgumentException ex) when (ex.Message.Contains("does not exists"))
{
    // deploy/mount the certificate, then retry
}

Prevention

Store certificates in a fixed, well-known folder.
For containers, mount the certificate volume at the configured path.
Grant the service account read access to the certificate file.

When it happens

Trigger: Calling SetWebServiceTlsCertificate (or startup config load) with a path that does not exist on disk, or where the service account lacks permission to stat the file.

Common situations: Typo in the certificate path; certificate deployed to a different node/folder; relative path resolved against the wrong working directory; service account lacks read/list permissions; cert was rotated and the old path removed; container volume not mounted.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/bc91cb2591b10788. Report an issue: GitHub.