{"record":{"id":"88ffcdfee0d41f03","repo":"microsoft/garnet","slug":"certfilename-and-certsubjectname-cannot-both-be-nu","errorCode":null,"errorMessage":"CertFileName and CertSubjectName cannot both be null.","messagePattern":"CertFileName and CertSubjectName cannot both be null\\.","errorType":"exception","errorClass":"GarnetException","httpStatus":null,"severity":"error","filePath":"libs/server/TLS/GarnetTlsOptions.cs","lineNumber":127,"sourceCode":"            {\n                errorMessage = \"Cannot provide null cert-file-name.\";\n                logger?.LogError(\"Cannot provide null cert-file-name.\");\n                return false;\n            }\n\n            errorMessage = null;\n            CertFileName = certFileName;\n            CertPassword = certPassword;\n            TlsServerOptions = GetSslServerAuthenticationOptions();\n            return true;\n        }\n\n        SslServerAuthenticationOptions GetSslServerAuthenticationOptions()\n        {\n            if (CertFileName == null && CertSubjectName == null)\n            {\n                logger?.LogError(\"CertFileName and CertSubjectName cannot both be null.\");\n                throw new GarnetException(\"CertFileName and CertSubjectName cannot both be null.\");\n            }\n\n            if (CertFileName != null && CertSubjectName != null)\n            {\n                logger?.LogError(\"Cannot use CertFileName with CertSubjectName. Provide only one of them.\");\n                throw new GarnetException(\"Cannot use CertFileName with CertSubjectName. Provide only one of them.\");\n            }\n\n            // We support CertSubjectName only on Windows\n            if (CertSubjectName != null && !RuntimeInformation.IsOSPlatform(OSPlatform.Windows))\n            {\n                logger?.LogError(\"CertSubjectName is supported only on Windows.\");\n                throw new GarnetException(\"CertSubjectName is supported only on Windows.\");\n            }\n\n            if (CertificateRefreshFrequency < 0)\n            {\n                logger?.LogError(\"CertificateRefreshFrequency should not be less than 0.\");","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/server/TLS/GarnetTlsOptions.cs#L109-L145","documentation":"Garnet's TLS configuration requires exactly one certificate source. When both CertFileName and CertSubjectName are null, GetSslServerAuthenticationOptions() throws because it cannot create an SSL server without a certificate. This is a hard prerequisite for TLS-enabled operation.","triggerScenarios":"Constructing GarnetTlsOptions or calling GetSslServerAuthenticationOptions() when neither --cert-file-name nor --cert-subject-name was provided. Occurs when TLS is enabled (the options object is constructed) but no certificate source is configured.","commonSituations":"Enabling TLS via --auth or other flags but forgetting to specify the certificate; config file with a commented-out cert line; environment variable for cert name not set in the deployment.","solutions":["Provide --cert-file-name <path> with --cert-password <password> for a PFX/PEM file.","Provide --cert-subject-name <name> for Windows certificate store lookup (Windows only).","Ensure the config file or environment variable supplying the cert name is correctly set and not empty."],"exampleFix":"// before\n--cert-file-name \"\" --cert-subject-name \"\"\n\n// after\n--cert-file-name /etc/garnet/cert.pfx --cert-password mypassword","handlingStrategy":"validation","validationCode":"if (string.IsNullOrEmpty(options.CertFileName) && string.IsNullOrEmpty(options.CertSubjectName))\n    throw new InvalidOperationException(\"TLS requires either --cert-file-name or --cert-subject-name.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always specify exactly one certificate source when TLS is enabled.","Use a config validator that checks cert sources before deployment.","Set cert sources via environment variables with non-empty defaults in production."],"tags":["tls","certificate","configuration","security","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}