{"record":{"id":"cfa1453767f5f48b","repo":"TechnitiumSoftware/DnsServer","slug":"dns-optional-protocols-tls-certificate-path-cannot","errorCode":null,"errorMessage":"DNS optional protocols TLS certificate path cannot be null or empty.","messagePattern":"DNS optional protocols TLS certificate path cannot be null or empty\\.","errorType":"validation","errorClass":"ArgumentNullException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":1640,"sourceCode":"            _log.Write(\"DNS Server TLS certificate was loaded: \" + tlsCertificatePath);\n        }\n\n        public void RemoveDnsTlsCertificate()\n        {\n            _dotSslServerAuthenticationOptions = null;\n            _doqSslServerAuthenticationOptions = null;\n            _dohSslServerAuthenticationOptions = null;\n\n            _dnsTlsCertificatePath = null;\n            _dnsTlsCertificatePassword = null;\n\n            StopTlsCertificateUpdateTimer();\n        }\n\n        public void SetDnsTlsCertificate(string dnsTlsCertificatePath, string dnsTlsCertificatePassword = null, bool throwException = false)\n        {\n            if (string.IsNullOrEmpty(dnsTlsCertificatePath))\n                throw new ArgumentNullException(nameof(dnsTlsCertificatePath), \"DNS optional protocols TLS certificate path cannot be null or empty.\");\n\n            if (dnsTlsCertificatePath.Length > 255)\n                throw new ArgumentException(\"DNS optional protocols TLS certificate path length cannot exceed 255 characters.\", nameof(dnsTlsCertificatePath));\n\n            if (dnsTlsCertificatePassword?.Length > 255)\n                throw new ArgumentException(\"DNS optional protocols TLS certificate password length cannot exceed 255 characters.\", nameof(dnsTlsCertificatePassword));\n\n            dnsTlsCertificatePath = ConvertToAbsolutePath(dnsTlsCertificatePath);\n\n            if (throwException)\n            {\n                LoadDnsTlsCertificate(dnsTlsCertificatePath, dnsTlsCertificatePassword);\n            }\n            else\n            {\n                try\n                {\n                    LoadDnsTlsCertificate(dnsTlsCertificatePath, dnsTlsCertificatePassword);","sourceCodeStart":1622,"sourceCodeEnd":1658,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L1622-L1658","documentation":"Thrown by SetDnsTlsCertificate when dnsTlsCertificatePath is null or empty. This is the first guard before length and existence checks; it uses ArgumentNullException because the parameter contract is violated.","triggerScenarios":"Calling SetDnsTlsCertificate(null, ...) or SetDnsTlsCertificate(\"\", ...). Common when config deserialization yields a missing field, a UI submit sends no path, or a default value is unset.","commonSituations":"Configuration JSON missing the tlsCertificatePath key; environment variable not set in Docker; first-time setup where DoT/DoH/DoQ is enabled but no cert path supplied; programmatic integration forgetting to set the path.","solutions":["Provide a non-empty absolute or relative path to a .pfx/.p12 file.","Disable DoT/DoH/DoQ protocols if no TLS cert is intended, instead of passing null.","Validate config at startup and surface a friendly message before the call.","Set a sensible default in your configuration template so the field is never null."],"exampleFix":"// before\nserver.SetDnsTlsCertificate(config.CertPath, config.CertPass);\n\n// after\nif (string.IsNullOrWhiteSpace(config.CertPath))\n    throw new ConfigurationException(\"tlsCertificatePath is required when DoT/DoH/DoQ is enabled\");\nserver.SetDnsTlsCertificate(config.CertPath.Trim(), config.CertPass);","handlingStrategy":"validation","validationCode":"void EnsureCertPath(string p)\n{\n    if (string.IsNullOrWhiteSpace(p))\n        throw new ConfigurationException(\"tlsCertificatePath is required\");\n}","typeGuard":"static bool IsNonEmptyCertPath(string path) => !string.IsNullOrWhiteSpace(path);","tryCatchPattern":"try { server.SetDnsTlsCertificate(path, pass); }\ncatch (ArgumentNullException ex) when (ex.ParamName == \"dnsTlsCertificatePath\") { return BadRequest(\"TLS cert path is required\"); }","preventionTips":["Mark the cert path as required in your config schema.","Disable DoT/DoH/DoQ if no cert is configured.","Default config templates should not allow null here."],"tags":["tls","certificate","argument","config"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}