{"record":{"id":"9cef122df2e834fa","repo":"microsoft/garnet","slug":"certificaterefreshfrequency-should-not-be-less-tha","errorCode":null,"errorMessage":"CertificateRefreshFrequency should not be less than 0.","messagePattern":"CertificateRefreshFrequency should not be less than 0\\.","errorType":"exception","errorClass":"GarnetException","httpStatus":null,"severity":"error","filePath":"libs/server/TLS/GarnetTlsOptions.cs","lineNumber":146,"sourceCode":"            }\n\n            if (CertFileName != null && CertSubjectName != null)\n            {\n                logger?.LogError(\"Cannot use CertFileName with CertSubjectName. Provide only one of them.\");\n                throw new GarnetException(\"Cannot use CertFileName with CertSubjectName. Provide only one of them.\");\n            }\n\n            // We support CertSubjectName only on Windows\n            if (CertSubjectName != null && !RuntimeInformation.IsOSPlatform(OSPlatform.Windows))\n            {\n                logger?.LogError(\"CertSubjectName is supported only on Windows.\");\n                throw new GarnetException(\"CertSubjectName is supported only on Windows.\");\n            }\n\n            if (CertificateRefreshFrequency < 0)\n            {\n                logger?.LogError(\"CertificateRefreshFrequency should not be less than 0.\");\n                throw new GarnetException(\"CertificateRefreshFrequency should not be less than 0.\");\n            }\n\n            // End timer associated with old certificate selector, if any\n            serverCertificateSelector?.EndTimer();\n\n            // Create new certificate selector\n            if (CertSubjectName == null)\n                serverCertificateSelector = new ServerCertificateSelector(CertFileName, CertPassword, CertificateRefreshFrequency, logger);\n            else\n                serverCertificateSelector = new ServerCertificateSelector(CertSubjectName, CertificateRefreshFrequency, logger);\n\n            return new SslServerAuthenticationOptions\n            {\n                ClientCertificateRequired = ClientCertificateRequired,\n                CertificateRevocationCheckMode = CertificateRevocationCheckMode,\n                RemoteCertificateValidationCallback = ValidateClientCertificateCallback(IssuerCertificatePath),\n                ServerCertificateSelectionCallback = (sender, hostName) =>\n                {","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/server/TLS/GarnetTlsOptions.cs#L128-L164","documentation":"Garnet validates that CertificateRefreshFrequency is non-negative. This value controls how often the server re-reads the certificate from disk or the Windows store to pick up rotations. A negative value would cause the refresh timer to behave incorrectly. The check fires in GetSslServerAuthenticationOptions() before the ServerCertificateSelector is constructed.","triggerScenarios":"Setting --cert-refresh-frequency to a negative value. For example, --cert-refresh-frequency -1 or a misconfigured environment variable that resolves to a negative number.","commonSituations":"Config file typo producing a negative value; environment variable defaulting to -1 as a sentinel that Garnet does not recognize; parsing error where a time unit is stripped leaving a bare negative number.","solutions":["Set --cert-refresh-frequency to 0 (disables refresh) or a positive value in seconds (e.g., --cert-refresh-frequency 3600).","Remove the flag to use the default value.","Check the config file for stray negative signs or unquoted values that parse incorrectly."],"exampleFix":"// before\n--cert-refresh-frequency -1\n\n// after\n--cert-refresh-frequency 0","handlingStrategy":"validation","validationCode":"if (options.CertificateRefreshFrequency < 0)\n    throw new ArgumentOutOfRangeException(nameof(options.CertificateRefreshFrequency), \"Must be >= 0.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set CertificateRefreshFrequency to 0 (no refresh) or a positive seconds value.","Validate numeric config values in a pre-startup check.","Avoid using negative sentinels in config; use 0 or omit the flag instead."],"tags":["tls","certificate","configuration","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}