{"record":{"id":"e4aba443cb27a740","repo":"TechnitiumSoftware/DnsServer","slug":"web-service-tls-certificate-file-must-be-pkcs-12","errorCode":null,"errorMessage":"Web Service TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: {tlsCertificatePath}","messagePattern":"Web Service TLS certificate file must be PKCS #12 formatted with \\.pfx or \\.p12 extension: (.+?)","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/DnsWebService.cs","lineNumber":2694,"sourceCode":"                _tlsCertificateUpdateTimer = null;\n            }\n        }\n\n        private void LoadWebServiceTlsCertificate(string tlsCertificatePath, string tlsCertificatePassword)\n        {\n            FileInfo fileInfo = new FileInfo(tlsCertificatePath);\n\n            if (!fileInfo.Exists)\n                throw new ArgumentException(\"Web Service TLS certificate file does not exists: \" + tlsCertificatePath);\n\n            switch (Path.GetExtension(tlsCertificatePath).ToLowerInvariant())\n            {\n                case \".pfx\":\n                case \".p12\":\n                    break;\n\n                default:\n                    throw new ArgumentException(\"Web Service TLS certificate file must be PKCS #12 formatted with .pfx or .p12 extension: \" + tlsCertificatePath);\n            }\n\n            X509Certificate2Collection certificateCollection = X509CertificateLoader.LoadPkcs12CollectionFromFile(tlsCertificatePath, tlsCertificatePassword, X509KeyStorageFlags.PersistKeySet);\n            X509Certificate2 serverCertificate = null;\n\n            foreach (X509Certificate2 certificate in certificateCollection)\n            {\n                if (certificate.HasPrivateKey)\n                {\n                    serverCertificate = certificate;\n                    break;\n                }\n            }\n\n            if (serverCertificate is null)\n                throw new ArgumentException(\"Web Service TLS certificate file must contain a certificate with private key.\");\n\n            List<SslApplicationProtocol> applicationProtocols = new List<SslApplicationProtocol>();","sourceCodeStart":2676,"sourceCodeEnd":2712,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/DnsWebService.cs#L2676-L2712","documentation":"ArgumentException thrown by LoadWebServiceTlsCertificate when the certificate file's extension (lowercased) is not .pfx or .p12. The loader only accepts PKCS #12 bundles, so any other extension is rejected before attempting to parse.","triggerScenarios":"Pointing SetWebServiceTlsCertificate at a .crt, .cer, .pem, .key, .der or extension-less file. The format check happens before the PKCS12 load attempt.","commonSituations":"Exporting the cert from a CA in PEM/DER instead of PFX; renaming but not converting the file; supplying the private key file separately; certificate tooling defaulting to .crt.","solutions":["Convert the certificate+private key into a PKCS #12 (.pfx/.p12) bundle (e.g. openssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx).","Rename only if the file is genuinely already PKCS #12; otherwise re-export from the source.","Confirm the file truly contains the private key in PKCS #12 format after conversion."],"exampleFix":"# before: webService.config points at server.crt\n# convert PEM cert + key into PFX\nopenssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx\n# then set webService TLS cert path to server.pfx","handlingStrategy":"validation","validationCode":"string ext = Path.GetExtension(webServiceTlsCertificatePath).ToLowerInvariant();\nif (ext != \".pfx\" && ext != \".p12\")\n    throw new ArgumentException(\"Certificate must be .pfx or .p12 (PKCS #12).\");","typeGuard":"static bool IsPkcs12Extension(string path)\n{\n    string ext = Path.GetExtension(path).ToLowerInvariant();\n    return ext == \".pfx\" || ext == \".p12\";\n}","tryCatchPattern":"null","preventionTips":["Always export certificates as PKCS #12 (.pfx/.p12).","Verify the extension and format as part of deployment checks.","Keep PEM/DER files out of the TLS certificate path."],"tags":["dns-server","technitium","tls","certificate","pkcs12","configuration","csharp"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}