{"record":{"id":"a3c7f2bd6d77c331","repo":"TechnitiumSoftware/DnsServer","slug":"web-service-tls-certificate-password-length-cannot","errorCode":null,"errorMessage":"Web service TLS certificate password length cannot exceed 255 characters.","messagePattern":"Web service TLS certificate password length cannot exceed 255 characters\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/DnsWebService.cs","lineNumber":2752,"sourceCode":"        {\n            _webServiceSslServerAuthenticationOptions = null;\n\n            _webServiceTlsCertificatePath = null;\n            _webServiceTlsCertificatePassword = null;\n\n            StopTlsCertificateUpdateTimer();\n        }\n\n        public void SetWebServiceTlsCertificate(string webServiceTlsCertificatePath, string webServiceTlsCertificatePassword)\n        {\n            if (string.IsNullOrWhiteSpace(webServiceTlsCertificatePath))\n                throw new ArgumentException(\"Web service TLS certificate path cannot be null or empty.\", nameof(webServiceTlsCertificatePath));\n\n            if (webServiceTlsCertificatePath.Length > 255)\n                throw new ArgumentException(\"Web service TLS certificate path length cannot exceed 255 characters.\", nameof(webServiceTlsCertificatePath));\n\n            if (webServiceTlsCertificatePassword?.Length > 255)\n                throw new ArgumentException(\"Web service TLS certificate password length cannot exceed 255 characters.\", nameof(webServiceTlsCertificatePassword));\n\n            webServiceTlsCertificatePath = ConvertToAbsolutePath(webServiceTlsCertificatePath);\n\n            LoadWebServiceTlsCertificate(webServiceTlsCertificatePath, webServiceTlsCertificatePassword);\n\n            _webServiceTlsCertificatePath = ConvertToRelativePath(webServiceTlsCertificatePath);\n            _webServiceTlsCertificatePassword = webServiceTlsCertificatePassword;\n\n            StartTlsCertificateUpdateTimer();\n        }\n\n        private void CheckAndLoadSelfSignedCertificate(bool forceGenerateNew, bool throwException)\n        {\n            string selfSignedCertificateFilePath = Path.Combine(_configFolder, \"self-signed-cert.pfx\");\n\n            if (_webServiceUseSelfSignedTlsCertificate)\n            {\n                string oldSelfSignedCertificateFilePath = Path.Combine(_configFolder, \"cert.pfx\");","sourceCodeStart":2734,"sourceCodeEnd":2770,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/DnsWebService.cs#L2734-L2770","documentation":"ArgumentException thrown by SetWebServiceTlsCertificate when the supplied certificate password is longer than 255 characters. As with the path, the password is persisted into the length-prefixed binary config, so it must fit a single byte length.","triggerScenarios":"Calling SetWebServiceTlsCertificate with a password string longer than 255 characters.","commonSituations":"Auto-generated very long random password; pasting a passphrase with extra tokens; password manager producing an oversized string.","solutions":["Re-export the PFX with a password of 255 characters or fewer.","Use a strong but <=255-char passphrase when generating the PKCS #12 bundle."],"exampleFix":"null","handlingStrategy":"validation","validationCode":"if ((webServiceTlsCertificatePassword?.Length ?? 0) > 255)\n    throw new ArgumentException(\"TLS certificate password must be <= 255 characters.\");","typeGuard":"static bool PasswordLengthIsValid(string password) => (password?.Length ?? 0) <= 255;","tryCatchPattern":"null","preventionTips":["Use strong but reasonably sized PFX passphrases (<=255 chars).","When auto-generating passwords, cap the generator length.","Validate config values before applying them."],"tags":["dns-server","technitium","tls","certificate","input-validation","configuration","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}