{"record":{"id":"857f88795bd74681","repo":"BeyondDimension/SteamTools","slug":"could-not-install-certificate-as-it-is-null-or-emp","errorCode":null,"errorMessage":"Could not install certificate as it is null or empty.","messagePattern":"Could not install certificate as it is null or empty\\.","errorType":"exception","errorClass":"ApplicationException","httpStatus":null,"severity":"error","filePath":"src/BD.WTTS.Client.Plugins.Accelerator.ReverseProxy/Services.Implementation/Certificate/CertificateManagerImpl.cs","lineNumber":96,"sourceCode":"            {\n                Log.Error(TAG, \"Loaded root certificate has expired.\");\n                return null;\n            }\n            return rootCert;\n        }\n        catch (Exception ex)\n        {\n            Log.Error(TAG, ex, nameof(LoadRootCertificate));\n            return null;\n        }\n    }\n\n    [Obsolete(\"use ICertificateManager.Constants.TrustRootCertificate\")]\n    void SharedTrustRootCertificate()\n    {\n        if (RootCertificate == null)\n        {\n            throw new ApplicationException(\n                \"Could not install certificate as it is null or empty.\");\n        }\n\n        using var store = new X509Store(StoreName.Root, StoreLocation.LocalMachine);\n        try\n        {\n            store.Open(OpenFlags.ReadWrite);\n\n            //var subjectName = RootCertificate.Subject[3..];\n            //foreach (var item in store.Certificates.Find(X509FindType.FindBySubjectName, subjectName, false))\n            //{\n            //    if (item.Thumbprint != RootCertificate.Thumbprint)\n            //    {\n            //        store.Remove(item);\n            //    }\n            //}\n\n            if (store.Certificates.Find(X509FindType.FindByThumbprint, RootCertificate.Thumbprint, true).Count == 0)","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/BeyondDimension/SteamTools/blob/c16ffa08e03b192d23ada290c4969e77f9201f3d/src/BD.WTTS.Client.Plugins.Accelerator.ReverseProxy/Services.Implementation/Certificate/CertificateManagerImpl.cs#L78-L114","documentation":"Thrown by the obsolete SharedTrustRootCertificate path when RootCertificate is null at the moment it tries to install the root cert into the Windows LocalMachine Root store. A null RootCertificate means the in-memory certificate object was never populated (load/generate failed or was skipped) before the trust step ran.","triggerScenarios":"Calling SharedTrustRootCertificate (directly or via legacy code paths) before LoadRootCertificate/GenerateCertificate has populated RootCertificate, or after those returned null due to a missing/corrupt PFX or wrong password.","commonSituations":"PFX file missing or deleted; PFX password changed or not supplied; certificate generation threw and was swallowed earlier; first-run on a fresh profile where generation failed silently; calling the obsolete method instead of ICertificateManager.Constants.TrustRootCertificate.","solutions":["Call GenerateCertificate() first and confirm RootCertificate is non-null before trusting.","Verify Interface.PfxFilePath exists and GetPfxPassword() returns the correct password.","Delete any half-written PFX so generation recreates it cleanly, then retry.","Migrate off the obsolete method to ICertificateManager.Constants.TrustRootCertificate."],"exampleFix":"// before\nSharedTrustRootCertificate(); // RootCertificate may be null\n\n// after\nif (RootCertificate == null) GenerateCertificate();\nif (RootCertificate == null)\n    throw new InvalidOperationException(\"Certificate generation failed; cannot trust.\");\nICertificateManager.Constants.TrustRootCertificate(GetCerFilePathGeneratedWhenNoFileExists, platformService, RootCertificate);","handlingStrategy":"validation","validationCode":"// Ensure the cert is loaded/generated before trusting.\nif (certificateManager.RootCertificate == null)\n    certificateManager.GenerateCertificate();\nif (certificateManager.RootCertificate == null)\n    throw new InvalidOperationException(\n        $\"Cannot trust root cert; PFX missing at {pfxFilePath} or password invalid.\");\ncertificateManager.TrustRootCertificate();","typeGuard":"bool HasRootCertificate(ICertificateManager mgr) => mgr.RootCertificate != null;","tryCatchPattern":"try { certificateManager.SharedTrustRootCertificate(); }\ncatch (ApplicationException ex) when (ex.Message.Contains(\"null or empty\"))\n{\n    Log.Error(TAG, ex, \"RootCertificate was null at trust time; attempting regeneration.\");\n    certificateManager.GenerateCertificate();\n    certificateManager.TrustRootCertificate(); // uses the non-obsolete path\n}","preventionTips":["Never call the trust/remove path without first guaranteeing RootCertificate is non-null.","Migrate off the obsolete SharedTrustRootCertificate to ICertificateManager.Constants.TrustRootCertificate.","Verify the PFX file exists and the password source is unlocked before any cert operation.","Log the cert generation result so a null RootCertificate has a traceable cause."],"tags":["certificate","tls","windows","configuration"],"backgroundTag":null,"analyzedSha":"c16ffa08e03b192d23ada290c4969e77f9201f3d","analyzedAt":"2026-08-13T11:52:20.410Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}