TechnitiumSoftware/DnsServer · error · ArgumentException

Web service TLS certificate password length cannot exceed 25

Error message

Web service TLS certificate password length cannot exceed 255 characters.

What it means

ArgumentException thrown by SetWebServiceTlsCertificate when the supplied certificate password is longer than 255 characters. As with the path, the password is persisted into the length-prefixed binary config, so it must fit a single byte length.

Source

Thrown at DnsServerCore/DnsWebService.cs:2752

        {
            _webServiceSslServerAuthenticationOptions = null;

            _webServiceTlsCertificatePath = null;
            _webServiceTlsCertificatePassword = null;

            StopTlsCertificateUpdateTimer();
        }

        public void SetWebServiceTlsCertificate(string webServiceTlsCertificatePath, string webServiceTlsCertificatePassword)
        {
            if (string.IsNullOrWhiteSpace(webServiceTlsCertificatePath))
                throw new ArgumentException("Web service TLS certificate path cannot be null or empty.", nameof(webServiceTlsCertificatePath));

            if (webServiceTlsCertificatePath.Length > 255)
                throw new ArgumentException("Web service TLS certificate path length cannot exceed 255 characters.", nameof(webServiceTlsCertificatePath));

            if (webServiceTlsCertificatePassword?.Length > 255)
                throw new ArgumentException("Web service TLS certificate password length cannot exceed 255 characters.", nameof(webServiceTlsCertificatePassword));

            webServiceTlsCertificatePath = ConvertToAbsolutePath(webServiceTlsCertificatePath);

            LoadWebServiceTlsCertificate(webServiceTlsCertificatePath, webServiceTlsCertificatePassword);

            _webServiceTlsCertificatePath = ConvertToRelativePath(webServiceTlsCertificatePath);
            _webServiceTlsCertificatePassword = webServiceTlsCertificatePassword;

            StartTlsCertificateUpdateTimer();
        }

        private void CheckAndLoadSelfSignedCertificate(bool forceGenerateNew, bool throwException)
        {
            string selfSignedCertificateFilePath = Path.Combine(_configFolder, "self-signed-cert.pfx");

            if (_webServiceUseSelfSignedTlsCertificate)
            {
                string oldSelfSignedCertificateFilePath = Path.Combine(_configFolder, "cert.pfx");

View on GitHub (pinned to d0484b6c1e)

Solutions

Re-export the PFX with a password of 255 characters or fewer.
Use a strong but <=255-char passphrase when generating the PKCS #12 bundle.

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

if ((webServiceTlsCertificatePassword?.Length ?? 0) > 255)
    throw new ArgumentException("TLS certificate password must be <= 255 characters.");

Type guard

static bool PasswordLengthIsValid(string password) => (password?.Length ?? 0) <= 255;

Try / catch

null

Prevention

Use strong but reasonably sized PFX passphrases (<=255 chars).
When auto-generating passwords, cap the generator length.
Validate config values before applying them.

When it happens

Trigger: Calling SetWebServiceTlsCertificate with a password string longer than 255 characters.

Common situations: Auto-generated very long random password; pasting a passphrase with extra tokens; password manager producing an oversized string.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/a3c7f2bd6d77c331. Report an issue: GitHub.