What causes "Web service TLS certificate path cannot be null or empty." in TechnitiumSoftware/DnsServer?

Provide a non-empty path to a .pfx/.p12 certificate file.

TechnitiumSoftware/DnsServer · error · ArgumentException

Web service TLS certificate path cannot be null or empty.

Error message

Web service TLS certificate path cannot be null or empty.

What it means

ArgumentException thrown by SetWebServiceTlsCertificate when the supplied certificate path is null, empty, or whitespace. The path is mandatory before any length/format checks or absolute-path conversion.

Source

Thrown at DnsServerCore/DnsWebService.cs:2746

            _webServiceCertificateLastModifiedOn = fileInfo.LastWriteTimeUtc;

            _log.Write("Web Service TLS certificate was loaded: " + tlsCertificatePath);
        }

        private void RemoveWebServiceTlsCertificate()
        {
            _webServiceSslServerAuthenticationOptions = null;

            _webServiceTlsCertificatePath = null;
            _webServiceTlsCertificatePassword = null;

            StopTlsCertificateUpdateTimer();
        }

        public void SetWebServiceTlsCertificate(string webServiceTlsCertificatePath, string webServiceTlsCertificatePassword)
        {
            if (string.IsNullOrWhiteSpace(webServiceTlsCertificatePath))
                throw new ArgumentException("Web service TLS certificate path cannot be null or empty.", nameof(webServiceTlsCertificatePath));

            if (webServiceTlsCertificatePath.Length > 255)
                throw new ArgumentException("Web service TLS certificate path length cannot exceed 255 characters.", nameof(webServiceTlsCertificatePath));

            if (webServiceTlsCertificatePassword?.Length > 255)
                throw new ArgumentException("Web service TLS certificate password length cannot exceed 255 characters.", nameof(webServiceTlsCertificatePassword));

            webServiceTlsCertificatePath = ConvertToAbsolutePath(webServiceTlsCertificatePath);

            LoadWebServiceTlsCertificate(webServiceTlsCertificatePath, webServiceTlsCertificatePassword);

            _webServiceTlsCertificatePath = ConvertToRelativePath(webServiceTlsCertificatePath);
            _webServiceTlsCertificatePassword = webServiceTlsCertificatePassword;

            StartTlsCertificateUpdateTimer();
        }

        private void CheckAndLoadSelfSignedCertificate(bool forceGenerateNew, bool throwException)

View on GitHub (pinned to d0484b6c1e)

Solutions

Provide a non-empty path to a .pfx/.p12 certificate file.
Validate the path field is set before calling SetWebServiceTlsCertificate.
If TLS is not required, disable TLS instead of passing an empty path.

Example fix

// before
_dnsWebService.SetWebServiceTlsCertificate(path, password); // path may be null

// after
if (!string.IsNullOrWhiteSpace(path))
    _dnsWebService.SetWebServiceTlsCertificate(path, password);

Defensive patterns

Strategy: validation

Validate before calling

if (string.IsNullOrWhiteSpace(webServiceTlsCertificatePath))
    throw new ArgumentException("TLS certificate path is required.");

Type guard

static bool HasTlsCertPath(string path) => !string.IsNullOrWhiteSpace(path);

Try / catch

null

Prevention

Validate required config fields before calling SetWebServiceTlsCertificate.
Default unset fields to a sentinel and refuse empty values.
Disable TLS explicitly rather than passing an empty path.

When it happens

Trigger: Calling SetWebServiceTlsCertificate with null, "", or a whitespace-only string for webServiceTlsCertificatePath.

Common situations: Config UI/API call with a missing field; script passing an unset environment variable; JSON config with an empty/omitted path; programmatic caller defaulting to null.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/eb84d5fae06d4c32. Report an issue: GitHub.