{"record":{"id":"f09907f05cb57909","repo":"TechnitiumSoftware/DnsServer","slug":"dns-optional-protocols-tls-certificate-password-le","errorCode":null,"errorMessage":"DNS optional protocols TLS certificate password length cannot exceed 255 characters.","messagePattern":"DNS optional protocols TLS certificate password length cannot exceed 255 characters\\.","errorType":"validation","errorClass":"ArgumentException","httpStatus":null,"severity":"warning","filePath":"DnsServerCore/Dns/DnsServer.cs","lineNumber":1646,"sourceCode":"            _doqSslServerAuthenticationOptions = null;\n            _dohSslServerAuthenticationOptions = null;\n\n            _dnsTlsCertificatePath = null;\n            _dnsTlsCertificatePassword = null;\n\n            StopTlsCertificateUpdateTimer();\n        }\n\n        public void SetDnsTlsCertificate(string dnsTlsCertificatePath, string dnsTlsCertificatePassword = null, bool throwException = false)\n        {\n            if (string.IsNullOrEmpty(dnsTlsCertificatePath))\n                throw new ArgumentNullException(nameof(dnsTlsCertificatePath), \"DNS optional protocols TLS certificate path cannot be null or empty.\");\n\n            if (dnsTlsCertificatePath.Length > 255)\n                throw new ArgumentException(\"DNS optional protocols TLS certificate path length cannot exceed 255 characters.\", nameof(dnsTlsCertificatePath));\n\n            if (dnsTlsCertificatePassword?.Length > 255)\n                throw new ArgumentException(\"DNS optional protocols TLS certificate password length cannot exceed 255 characters.\", nameof(dnsTlsCertificatePassword));\n\n            dnsTlsCertificatePath = ConvertToAbsolutePath(dnsTlsCertificatePath);\n\n            if (throwException)\n            {\n                LoadDnsTlsCertificate(dnsTlsCertificatePath, dnsTlsCertificatePassword);\n            }\n            else\n            {\n                try\n                {\n                    LoadDnsTlsCertificate(dnsTlsCertificatePath, dnsTlsCertificatePassword);\n                }\n                catch (Exception ex)\n                {\n                    _log.Write(\"DNS Server encountered an error while loading DNS Server TLS certificate: \" + dnsTlsCertificatePath, ex);\n                }\n            }","sourceCodeStart":1628,"sourceCodeEnd":1664,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Dns/DnsServer.cs#L1628-L1664","documentation":"Thrown by SetDnsTlsCertificate when the supplied certificate password is longer than 255 characters. The cap mirrors the server's config serialization budget; the password is optional (null is allowed), but if present it must be short.","triggerScenarios":"Passing an arbitrarily long string as dnsTlsCertificatePassword (e.g. a full PEM key pasted by mistake, a token, or a passphrase generated by a password manager without a length cap).","commonSituations":"Operator pastes the private key contents into the password field; an automation pipeline injects an OAuth token instead of the PKCS12 passphrase; password manager configured to generate 256+ char passwords.","solutions":["Use a shorter passphrase (<= 255 chars) when exporting the .pfx.","Double-check the field actually expects the PKCS12 password and not a key or token.","Re-export the .pfx with openssl using a concise password.","Validate password length in your config pipeline before submission."],"exampleFix":"# before: openssl pkcs12 -export ... -password pass:$(cat giant-token.txt)\n\n# after\nexport PFX_PASS='correct-horse-battery'  # <= 255 chars\nopenssl pkcs12 -export -in cert.pem -inkey key.pem -out cert.pfx -password pass:$PFX_PASS\nserver.SetDnsTlsCertificate(\"cert.pfx\", PFX_PASS);","handlingStrategy":"validation","validationCode":"void EnsureCertPass(string? p)\n{\n    if (p is not null && p.Length > 255)\n        throw new ConfigurationException(\"TLS cert password must be <= 255 chars\");\n}","typeGuard":"static bool IsCertPasswordLengthOk(string? password) => password is null || password.Length <= 255;","tryCatchPattern":"try { server.SetDnsTlsCertificate(path, pass); }\ncatch (ArgumentException ex) when (ex.Message.Contains(\"password length cannot exceed\")) { return BadRequest(\"Use a shorter PFX password\"); }","preventionTips":["Use concise passphrases when exporting .pfx files.","Confirm the password field is not receiving a key or token.","Validate password length in CI config checks."],"tags":["tls","certificate","password","length"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}