{"record":{"id":"ac04de01722f06df","repo":"NationalSecurityAgency/ghidra","slug":"path-to-certificate-necessary-to-start-server-c","errorCode":null,"errorMessage":"Path to certificate necessary to start server (--cert /path/to/cert)","messagePattern":"Path to certificate necessary to start server \\(--cert /path/to/cert\\)","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java","lineNumber":1011,"sourceCode":"\t/**\n\t * Start a PostgreSQL server, configured for BSim, on the local host.\n\t * If the data directory is already populated, the server process is simply restarted.\n\t * If the data directory is empty, a new server configuration is established, and the server is started.\n\t * Authentication may be necessary, either via password or certificate, in order to enable\n\t * the BSim extension on the server\n\t * \n\t * @throws IOException if postgres cannot be started \n\t * @throws InterruptedException if the process fails during the run\n\t * @throws SAXException if the data directory cannot be initialized\n\t * @throws GeneralSecurityException if the authentication fails\n\t */\n\tprivate void startCommand()\n\t\t\tthrows IOException, InterruptedException, SAXException, GeneralSecurityException {\n\t\tdiscoverPostgresInstall();\n\t\tinitializeDataDirectory();\n\n\t\tif (localAuthentication == AUTHENTICATION_PKI && certParameter == null) {\n\t\t\tthrow new GeneralSecurityException(\n\t\t\t\t\"Path to certificate necessary to start server (--cert /path/to/cert)\");\n\t\t}\n\t\tFile logFile = new File(dataDirectory, \"logfile\");\n\t\tList<String> command = new ArrayList<String>();\n\t\tcommand.add(postgresControl.getAbsolutePath());\n\t\tcommand.add(\"start\");\n\t\tcommand.add(\"-w\");\n\t\tcommand.add(\"-D\");\n\t\tcommand.add(dataDirectory.getAbsolutePath());\n\t\tcommand.add(\"-l\");\n\t\tcommand.add(logFile.getAbsolutePath());\n\t\tint res = runCommand(null, command, loadLibraryVar, loadLibraryValue);\n\t\tif (res != 0) {\n\t\t\tthrow new IOException(\"Could not start postgres server process\");\n\t\t}\n\n\t\tSystem.out.println(\"Server started\");\n\t\tboolean extensionEnabled = true;","sourceCodeStart":993,"sourceCodeEnd":1029,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java#L993-L1029","documentation":"Thrown by startCommand() when localAuthentication is PKI but certParameter (the `--cert` client certificate path) is null. PostgreSQL cert auth requires the client to present a certificate, so BSim refuses to start the server without the client cert path.","triggerScenarios":"Running `bsim_ctl start --auth cert ...` (which sets localAuthentication=PKI) without the global `--cert /path/to/client.crt` option.","commonSituations":"Operator supplies --cafile/--dn but forgets --cert; confuses server CA (--cafile) with client cert (--cert); running start with --noLocalAuth omitted so local PKI still applies.","solutions":["Add `--cert /path/to/client.crt` to the start command.","Confirm the client certificate matches the CA in --cafile and the CN in --dn.","If local PKI is unwanted, pass `--noLocalAuth` so localAuthentication is downgraded."],"exampleFix":"// before\nbsim_ctl start --auth cert --cafile root.crt --dn \"CN=bsim_admin\" /var/bsim/data\n// after\nbsim_ctl start --auth cert --cafile root.crt --dn \"CN=bsim_admin\" --cert client.crt /var/bsim/data","handlingStrategy":"validation","validationCode":"boolean pkiLocal = \"cert\".equals(authMode) && !noLocalAuth;\nif (pkiLocal && (certPath == null || certPath.isBlank())) {\n    throw new IllegalArgumentException(\n        \"--cert <client.crt> is required for PKI local auth on start\");\n}","typeGuard":"public boolean isStartPkiComplete(BsimCtlOptions o) {\n    boolean pki = \"cert\".equals(o.auth);\n    boolean localPki = pki && !o.noLocalAuth;\n    return !localPki || (o.cert != null && new File(o.cert).isFile());\n}","tryCatchPattern":"try {\n    bsimControl.start(args);\n} catch (GeneralSecurityException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Path to certificate necessary to start server\")) {\n        throw new UserFacingException(\"Add --cert <client.crt> for PKI start\", e);\n    }\n    throw e;\n}","preventionTips":["Pair --auth cert with --cert (client) distinct from --cafile (server CA).","Use --noLocalAuth if you do not want local PKI to require a client cert."],"tags":["pki","authentication","certificate","configuration","bsim","cli"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}