Skip to content

Conversation

@pauld-0110
Copy link

Problem

When starting the DNS Server in Docker for the first time with HTTPS enabled via environment variables (e.g., DNS_SERVER_WEB_SERVICE_ENABLE_HTTPS=true), the TLS certificates failed to load, causing HTTPS to not bind.
A container restart was required for HTTPS to work properly.

Root Cause

The certificate loading process in LoadConfigFile() was called before _dnsServer was initialized in StartAsync(). The CheckAndLoadSelfSignedCertificate() method requires _dnsServer.ServerDomain to generate self-signed certificates (line 2252), which caused a NullReferenceException that was silently caught during the first startup.

Solution

Deferred certificate loading until after _dnsServer initialization by:

  • Added flags to track pending certificate operations:
    _pendingLoadCustomCertificate - for custom certificate paths
    _pendingLoadSelfSignedCertificate - for self-signed certificates
  • Modified LoadConfigFile() to set flags instead of immediately loading certificates when reading from environment variables
  • Added certificate loading in StartAsync() after _dnsServer initialization but before web service starts

Testing

Tested on first Docker container start with:

  • Self-signed certificates (DNS_SERVER_WEB_SERVICE_USE_SELF_SIGNED_CERT=true)
  • Custom certificates (DNS_SERVER_WEB_SERVICE_TLS_CERTIFICATE_PATH=/path/to/cert.pfx)
  • Container restart (existing config file)

Log output showing successful first-start HTTPS binding:

[2025-11-25 10:06:54 Local] Web Service TLS certificate was loaded: /etc/ssl/wildcard-certificate.pfx
[2025-11-25 10:06:54 Local] [0.0.0.0:80] [HTTP] Web Service was bound successfully.
[2025-11-25 10:06:54 Local] [0.0.0.0:443] [HTTPS] Web Service was bound successfully.

Certificates are now properly loaded when HTTPS is configured via environment
variables on first start, eliminating the need for a restart.
Certificates are now loaded after _dnsServer initialization to prevent
NullReferenceException when CheckAndLoadSelfSignedCertificate() accesses
_dnsServer.ServerDomain during first start from environment variables.
Certificates are now loaded after _dnsServer initialization to prevent
NullReferenceException when CheckAndLoadSelfSignedCertificate() accesses
_dnsServer.ServerDomain during first start from environment variables.

Adds defensive checks and proper flag management for edge cases.
@ShreyasZare
Copy link
Member

Thanks for the PR. Will evaluate it soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants