{"record":{"id":"94439920edd34537","repo":"TechnitiumSoftware/DnsServer","slug":"dns-optional-protocols-tls-certificate-path-length","errorCode":null,"errorMessage":"DNS optional protocols TLS certificate path length cannot exceed 255 characters.","messagePattern":"DNS optional protocols TLS certificate path length cannot exceed 255 characters\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":1643,"sourceCode":"        public void RemoveDnsTlsCertificate()\n        {\n            _dotSslServerAuthenticationOptions = null;\n            _doqSslServerAuthenticationOptions = null;\n            _dohSslServerAuthenticationOptions = null;\n\n            _dnsTlsCertificatePath = null;\n            _dnsTlsCertificatePassword = null;\n\n            StopTlsCertificateUpdateTimer();\n        }\n\n        public void SetDnsTlsCertificate(string dnsTlsCertificatePath, string dnsTlsCertificatePassword = null, bool throwException = false)\n        {\n            if (string.IsNullOrEmpty(dnsTlsCertificatePath))\n                throw new ArgumentNullException(nameof(dnsTlsCertificatePath), \"DNS optional protocols TLS certificate path cannot be null or empty.\");\n\n            if (dnsTlsCertificatePath.Length > 255)\n                throw new ArgumentException(\"DNS optional protocols TLS certificate path length cannot exceed 255 characters.\", nameof(dnsTlsCertificatePath));\n\n            if (dnsTlsCertificatePassword?.Length > 255)\n                throw new ArgumentException(\"DNS optional protocols TLS certificate password length cannot exceed 255 characters.\", nameof(dnsTlsCertificatePassword));\n\n            dnsTlsCertificatePath = ConvertToAbsolutePath(dnsTlsCertificatePath);\n\n            if (throwException)\n            {\n                LoadDnsTlsCertificate(dnsTlsCertificatePath, dnsTlsCertificatePassword);\n            }\n            else\n            {\n                try\n                {\n                    LoadDnsTlsCertificate(dnsTlsCertificatePath, dnsTlsCertificatePassword);\n                }\n                catch (Exception ex)\n                {","sourceCodeStart":1625,"sourceCodeEnd":1661,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L1625-L1661","documentation":"Thrown by SetDnsTlsCertificate when dnsTlsCertificatePath.Length exceeds 255. The cap matches filesystem/path limits and the server's config serialization budget; longer paths are rejected before filesystem access.","triggerScenarios":"Passing a deeply nested absolute path or a path with many segments such that total length > 255 characters.","commonSituations":"Long Windows drive paths (C:\\Users\\...\\very\\deep\\folder\\certificate.pfx); embedded base64 or hash in the filename; container overlayfs paths; misconfigured variable concatenation producing a long string.","solutions":["Shorten the path: place the cert in a shallow directory like /etc/dns/cert.pfx or C:\\certs\\dns.pfx.","Use a relative path if your working directory is near the file.","Symlink a short path to the long real location.","Trim accidental whitespace or duplicated separators before measuring length."],"exampleFix":"# before\n/var/lib/technitium-dns/server/data/apps/acme-issuer/store/2024/01/fullchain-bundled-3a9f8c.pfx\n\n# after\nln -s /var/lib/.../3a9f8c.pfx /etc/dns/cert.pfx\nserver.SetDnsTlsCertificate(\"/etc/dns/cert.pfx\", pw);","handlingStrategy":"validation","validationCode":"string ShortenCertPath(string p)\n{\n    var full = Path.GetFullPath(p);\n    if (full.Length > 255) throw new ConfigurationException($\"Cert path too long ({full.Length}): use a shallower directory or a symlink\");\n    return full;\n}","typeGuard":"static bool IsCertPathWithinLength(string path) => (path?.Length ?? 0) <= 255;","tryCatchPattern":"try { server.SetDnsTlsCertificate(path, pass); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"path length cannot exceed\")) { return BadRequest(\"Use a shorter certificate path\"); }","preventionTips":["Place certs in a shallow directory (/etc/dns/cert.pfx).","Use a symlink if the real path is long.","Validate path length before submission."],"tags":["tls","certificate","path-length","config"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}