{"record":{"id":"2b874edb6d7237c6","repo":"TechnitiumSoftware/DnsServer","slug":"dns-server-tls-certificate-file-does-not-exists","errorCode":null,"errorMessage":"DNS Server TLS certificate file does not exists: {tlsCertificatePath}","messagePattern":"DNS Server TLS certificate file does not exists: (.+?)","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":1564,"sourceCode":"                }, null, TLS_CERTIFICATE_UPDATE_TIMER_INITIAL_INTERVAL, TLS_CERTIFICATE_UPDATE_TIMER_INTERVAL);\n            }\n        }\n\n        private void StopTlsCertificateUpdateTimer()\n        {\n            if (_tlsCertificateUpdateTimer is not null)\n            {\n                _tlsCertificateUpdateTimer.Dispose();\n                _tlsCertificateUpdateTimer = null;\n            }\n        }\n\n        private void LoadDnsTlsCertificate(string tlsCertificatePath, string tlsCertificatePassword)\n        {\n            FileInfo fileInfo = new FileInfo(tlsCertificatePath);\n\n            if (!fileInfo.Exists)\n                throw new ArgumentException(\"DNS Server TLS certificate file does not exists: \" + tlsCertificatePath);\n\n            switch (Path.GetExtension(tlsCertificatePath).ToLowerInvariant())\n            {\n                case \".pfx\":\n                case \".p12\":\n                    break;\n\n                default:\n                    throw new ArgumentException(\"DNS Server TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: \" + tlsCertificatePath);\n            }\n\n            X509Certificate2Collection certificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(tlsCertificatePath, tlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);\n            X509Certificate2 serverCertificate = null;\n\n            foreach (X509Certificate2 certificate in certificateCollection)\n            {\n                if (certificate.HasPrivateKey)\n                {","sourceCodeStart":1546,"sourceCodeEnd":1582,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L1546-L1582","documentation":"Thrown by LoadDnsTlsCertificate when the FileInfo for tlsCertificatePath reports !Exists. The certificate path is checked before any PKCS#12 parsing, so the file must be present and readable on the server host.","triggerScenarios":"Calling SetDnsTlsCertificate(path, password) with a path that does not resolve on the server; relative path that resolves against the wrong working directory; certificate moved/deleted after a previous successful load; Docker volume not mounted.","commonSituations":"Path passed from the web UI but the file lives on the admin's workstation, not the server; Linux container without the cert volume; cert auto-renewed by certbot into a new path while the config still points at the old one; typos or unescaped spaces in the path.","solutions":["Confirm the cert file exists on the host running the DNS server (not the admin's machine): ls -l <path>.","Use an absolute path; the server converts via ConvertToAbsolutePath against its working directory.","In Docker, mount the certificate as a volume and reference the in-container path.","After renewal (certbot/acme), update SetDnsTlsCertificate to the new file or symlink a stable path."],"exampleFix":"// before\nserver.SetDnsTlsCertificate(\"cert.pfx\", pw);\n\n// after\nstring certPath = Path.GetFullPath(\"/var/dns/certs/cert.pfx\");\nif (!File.Exists(certPath)) throw new FileNotFoundException(certPath);\nserver.SetDnsTlsCertificate(certPath, pw);","handlingStrategy":"validation","validationCode":"string AbsoluteCertPath(string p)\n{\n    var full = Path.GetFullPath(p);\n    if (!File.Exists(full)) throw new FileNotFoundException(\"TLS cert not found\", full);\n    return full;\n}\n// server.SetDnsTlsCertificate(AbsoluteCertPath(path), pass);","typeGuard":"static bool TlsCertFileExists(string path) => File.Exists(Path.GetFullPath(path));","tryCatchPattern":"try { server.SetDnsTlsCertificate(path, pass, throwException: true); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"does not exists\")) { log.Error($\"Cert file missing: {path}\"); }","preventionTips":["Use absolute paths and confirm the file is on the server host.","In Docker, mount the cert as a volume and use the in-container path.","After renewal, update the path or use a stable symlink."],"tags":["tls","certificate","filesystem","dot-doh-doq"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}