TechnitiumSoftware/DnsServer · error · ArgumentException

Web Service TLS certificate file must be PKCS #12 formatted

Error message

Web Service TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: {tlsCertificatePath}

What it means

ArgumentException thrown by LoadWebServiceTlsCertificate when the certificate file's extension (lowercased) is not .pfx or .p12. The loader only accepts PKCS #12 bundles, so any other extension is rejected before attempting to parse.

Source

Thrown at DnsServerCore/DnsWebService.cs:2694

                _tlsCertificateUpdateTimer = null;
            }
        }

        private void LoadWebServiceTlsCertificate(string tlsCertificatePath, string tlsCertificatePassword)
        {
            FileInfo fileInfo = new FileInfo(tlsCertificatePath);

            if (!fileInfo.Exists)
                throw new ArgumentException("Web Service TLS certificate file does not exists: " + tlsCertificatePath);

            switch (Path.GetExtension(tlsCertificatePath).ToLowerInvariant())
            {
                case ".pfx":
                case ".p12":
                    break;

                default:
                    throw new ArgumentException("Web Service TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: " + tlsCertificatePath);
            }

            X509Certificate2Collection certificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(tlsCertificatePath, tlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);
            X509Certificate2 serverCertificate = null;

            foreach (X509Certificate2 certificate in certificateCollection)
            {
                if (certificate.HasPrivateKey)
                {
                    serverCertificate = certificate;
                    break;
                }
            }

            if (serverCertificate is null)
                throw new ArgumentException("Web Service TLS certificate file must contain a certificate with private key.");

            List<SslApplicationProtocol> applicationProtocols = new List<SslApplicationProtocol>();

View on GitHub (pinned to d0484b6c1e)

Solutions

Convert the certificate+private key into a PKCS #12 (.pfx/.p12) bundle (e.g. openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx).
Rename only if the file is genuinely already PKCS #12; otherwise re-export from the source.
Confirm the file truly contains the private key in PKCS #12 format after conversion.

Example fix

# before: webService.config points at server.crt
# convert PEM cert + key into PFX
openssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx
# then set webService TLS cert path to server.pfx

Defensive patterns

Strategy: validation

Validate before calling

string ext = Path.GetExtension(webServiceTlsCertificatePath).ToLowerInvariant();
if (ext != ".pfx" && ext != ".p12")
    throw new ArgumentException("Certificate must be .pfx or .p12 (PKCS #12).");

Type guard

static bool IsPkcs12Extension(string path)
{
    string ext = Path.GetExtension(path).ToLowerInvariant();
    return ext == ".pfx" || ext == ".p12";
}

Try / catch

null

Prevention

Always export certificates as PKCS #12 (.pfx/.p12).
Verify the extension and format as part of deployment checks.
Keep PEM/DER files out of the TLS certificate path.

When it happens

Trigger: Pointing SetWebServiceTlsCertificate at a .crt, .cer, .pem, .key, .der or extension-less file. The format check happens before the PKCS12 load attempt.

Common situations: Exporting the cert from a CA in PEM/DER instead of PFX; renaming but not converting the file; supplying the private key file separately; certificate tooling defaulting to .crt.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/e4aba443cb27a740. Report an issue: GitHub.