{"record":{"id":"bdc25d8246e202c7","repo":"microsoft/garnet","slug":"cannot-use-certfilename-with-certsubjectname-prov","errorCode":null,"errorMessage":"Cannot use CertFileName with CertSubjectName. Provide only one of them.","messagePattern":"Cannot use CertFileName with CertSubjectName\\. Provide only one of them\\.","errorType":"exception","errorClass":"GarnetException","httpStatus":null,"severity":"error","filePath":"libs/server/TLS/GarnetTlsOptions.cs","lineNumber":133,"sourceCode":"            errorMessage = null;\n            CertFileName = certFileName;\n            CertPassword = certPassword;\n            TlsServerOptions = GetSslServerAuthenticationOptions();\n            return true;\n        }\n\n        SslServerAuthenticationOptions GetSslServerAuthenticationOptions()\n        {\n            if (CertFileName == null && CertSubjectName == null)\n            {\n                logger?.LogError(\"CertFileName and CertSubjectName cannot both be null.\");\n                throw new GarnetException(\"CertFileName and CertSubjectName cannot both be null.\");\n            }\n\n            if (CertFileName != null && CertSubjectName != null)\n            {\n                logger?.LogError(\"Cannot use CertFileName with CertSubjectName. Provide only one of them.\");\n                throw new GarnetException(\"Cannot use CertFileName with CertSubjectName. Provide only one of them.\");\n            }\n\n            // We support CertSubjectName only on Windows\n            if (CertSubjectName != null && !RuntimeInformation.IsOSPlatform(OSPlatform.Windows))\n            {\n                logger?.LogError(\"CertSubjectName is supported only on Windows.\");\n                throw new GarnetException(\"CertSubjectName is supported only on Windows.\");\n            }\n\n            if (CertificateRefreshFrequency < 0)\n            {\n                logger?.LogError(\"CertificateRefreshFrequency should not be less than 0.\");\n                throw new GarnetException(\"CertificateRefreshFrequency should not be less than 0.\");\n            }\n\n            // End timer associated with old certificate selector, if any\n            serverCertificateSelector?.EndTimer();\n","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/microsoft/garnet/blob/951b0fc6838721f89d102c2bbe1b914e8d39d700/libs/server/TLS/GarnetTlsOptions.cs#L115-L151","documentation":"Garnet's TLS configuration rejects specifying both CertFileName (file-based cert) and CertSubjectName (Windows cert store lookup) simultaneously. Only one certificate source is allowed to avoid ambiguity about which certificate to use. The check fires in GetSslServerAuthenticationOptions() after the null-check.","triggerScenarios":"Providing both --cert-file-name and --cert-subject-name on the command line or in the config file. For example: --cert-file-name /path/cert.pfx --cert-subject-name CN=mycert.","commonSituations":"Copy-pasting a config template that had both options listed (one commented, both uncommented by mistake); migrating from file-based to store-based certs and leaving the old setting; environment variable for one cert source still set while the other is explicitly configured.","solutions":["Remove --cert-subject-name and keep only --cert-file-name (and --cert-password).","Remove --cert-file-name and keep only --cert-subject-name (Windows only).","Check environment variables and config files for stale certificate settings that conflict with command-line flags."],"exampleFix":"// before\n--cert-file-name /path/cert.pfx --cert-subject-name CN=mycert\n\n// after\n--cert-file-name /path/cert.pfx --cert-password mypassword","handlingStrategy":"validation","validationCode":"if (!string.IsNullOrEmpty(options.CertFileName) && !string.IsNullOrEmpty(options.CertSubjectName))\n    throw new InvalidOperationException(\"Specify only one of --cert-file-name or --cert-subject-name, not both.\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provide exactly one certificate source, never both.","Use config templating that conditionally includes only one cert option.","Audit environment variables for stale cert settings that may conflict with new ones."],"tags":["tls","certificate","configuration","security","garnet"],"backgroundTag":null,"analyzedSha":"951b0fc6838721f89d102c2bbe1b914e8d39d700","analyzedAt":"2026-08-13T19:01:32.939Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}