{"record":{"id":"50427a219b6c2ea9","repo":"TechnitiumSoftware/DnsServer","slug":"web-server-name-tls-certificate-file-must-be","errorCode":null,"errorMessage":"Web server '{_name}' TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: {webServerTlsCertificateFilePath}","messagePattern":"Web server '(.+?)' TLS certificate file must be PKCS #12 formatted with \\.pfx or \\.p12 extension: (.+?)","errorType":"exception","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"Apps/BlockPageApp/App.cs","lineNumber":478,"sourceCode":"                    _webServer = null;\n                }\n            }\n\n            private void LoadWebServiceTlsCertificate(string webServerTlsCertificateFilePath, string? webServerTlsCertificatePassword)\n            {\n                FileInfo fileInfo = new FileInfo(webServerTlsCertificateFilePath);\n\n                if (!fileInfo.Exists)\n                    throw new ArgumentException(\"Web server '\" + _name + \"' TLS certificate file does not exists: \" + webServerTlsCertificateFilePath);\n\n                switch (Path.GetExtension(webServerTlsCertificateFilePath).ToLowerInvariant())\n                {\n                    case \".pfx\":\n                    case \".p12\":\n                        break;\n\n                    default:\n                        throw new ArgumentException(\"Web server '\" + _name + \"' TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: \" + webServerTlsCertificateFilePath);\n                }\n\n                X509Certificate2Collection webServerTlsCertificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(webServerTlsCertificateFilePath, webServerTlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);\n                X509Certificate2? serverCertificate = null;\n\n                foreach (X509Certificate2 certificate in webServerTlsCertificateCollection)\n                {\n                    if (certificate.HasPrivateKey)\n                    {\n                        serverCertificate = certificate;\n                        break;\n                    }\n                }\n\n                if (serverCertificate is null)\n                    throw new ArgumentException(\"Web server '\" + _name + \"' TLS certificate file must contain a certificate with private key.\");\n\n                _sslServerAuthenticationOptions = new SslServerAuthenticationOptions()","sourceCodeStart":460,"sourceCodeEnd":496,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/Apps/BlockPageApp/App.cs#L460-L496","documentation":"Thrown by BlockPageApp LoadWebServiceTlsCertificate when the TLS certificate file exists but its extension is neither .pfx nor .p12. The loader only supports PKCS #12 bundles, so any other format (e.g. .crt, .pem, .cer, .key) raises ArgumentException.","triggerScenarios":"Configuring 'webServerTlsCertificateFilePath' to a PEM, DER, CRT, or CER file instead of a PKCS #12 (.pfx/.p12) bundle.","commonSituations":"Exporting only the public cert (.crt) or a PEM chain from a CA and pointing the config at it; using a Letsencrypt live file directly without conversion to PFX.","solutions":["Convert the certificate and its private key into a PKCS #12 bundle: 'openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt'.","Point 'webServerTlsCertificateFilePath' at the resulting .pfx (or .p12) file.","Make sure the .pfx includes the private key and use the matching password."],"exampleFix":"# convert PEM cert+key to PKCS#12\nopenssl pkcs12 -export -out blockpage.pfx -inkey privkey.pem -in fullchain.pem\n# then in dnsApp.config\n\"webServerTlsCertificateFilePath\": \"blockpage.pfx\"","handlingStrategy":"type-guard","validationCode":"string ext = Path.GetExtension(webServerTlsCertificateFilePath).ToLowerInvariant();\nif (ext != \".pfx\" && ext != \".p12\")\n    throw new FormatException($\"TLS certificate must be PKCS #12 (.pfx/.p12); got '{ext}'. Convert with: openssl pkcs12 -export -out server.pfx -inkey server.key -in server.crt\");","typeGuard":"static bool IsPkcs12File(string path)\n{\n    string ext = Path.GetExtension(path).ToLowerInvariant();\n    return ext == \".pfx\" || ext == \".p12\";\n}","tryCatchPattern":null,"preventionTips":["Export certificates as PKCS #12 bundles including the private key.","Use the .pfx or .p12 extension consistently.","Convert PEM/DER with OpenSSL before referencing in config."],"tags":["csharp","tls","certificate","pkcs12","config","technitium","block-page-app"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}