Message about value cannot be null appears when using a locally defined source

[opoplawski]

Checklist

• I confirm there are no unresolved issues reported on the Chocolatey Status page.
• I have verified this is the correct repository for opening this issue.
• I have verified no other issues exist related to my problem.
• I have verified this is not an issue for a specific package.
• I have verified this issue is not security related.
• I confirm I am using official, and not unofficial, or modified, Chocolatey products.

What You Are Seeing?

When running choco outdated --trace I get:

Chocolatey v2.5.0
 Operating System Version Number: 10.0.26100.0
Outdated Packages
 Output is Id | Version | Available Version | Pinned

Attempted to use a source name https://FQDN/repository/nuget-group/ to get default source but failed:
 Value cannot be null.
Parameter name: s

What is Expected?

No failure messages

How Did You Get This To Happen?

We have the following source defined that points to a local Sonatype Nexus3 repository:

choco source add --name "'NWRA'" --source="'https://FQDN/repository/nuget-group/'" --priority="'10'" --cert "'C:\ssl\private\client.pfx'"  --bypassProxy

choco source list shows:

chocolatey - https://community.chocolatey.org/api/v2/ | Priority 0|Bypass Proxy - False|Self-Service - False|Admin Only - False.
NWRA - https://FQDN/repository/nuget-group/ (Authenticated)| Priority 10|Bypass Proxy - True|Self-Service - False|Admin Only - False.

System Details

• Operating System: 10.0.26100.0
• Windows PowerShell version:

Name                           Value
----                           -----
PSVersion                      5.1.26100.4652
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.4652
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

• Chocolatey CLI Version: 2.5.0
• Chocolatey Licensed Extension version: Chocolatey v2.5.0
  0 packages installed.
• Chocolatey License type: Community
• Terminal/Emulator: PowerShell

Installed Packages

Chocolatey v2.5.0
7zip.install 25.0.0
adobereader 2025.1.20577
airtame 4.12.0
choco-cleaner 1.1.1
chocolatey 2.5.0
chocolatey-compatibility.extension 1.0.0
chocolatey-core.extension 1.4.0
chocolatey-dotnetfx.extension 1.0.1
chocolatey-windowsupdate.extension 1.0.5
cmake.install 4.0.3
DotNet4.5 4.5.20120822
Firefox 141.0.0
git.install 2.50.1
GoogleChrome 138.0.7204.169
KB2919355 1.0.20160915
KB2919442 1.0.20160915
KB2999226 1.0.20181019
KB3033929 1.0.5
KB3035131 1.0.3
KB3118401 1.0.5
keepass.install 2.59.0
microsoft-teams.install 1.8.0.18356
miniconda3 4.12.0
netfx-4.8 4.8.0.20220524
nxlog 3.2.2329
openssl 3.5.1
powershell-core 7.5.2
putty-cac 0.83.0.1
slack 4.45.64
thunderbird 139.0.2
ungoogled-chromium 137.0.7151.681
vcredist140 14.44.35211
vcredist2015 14.0.24215.20170201
Wget 1.21.4
winlogbeat-oss 7.12.1
wireshark 4.4.8
yubico-authenticator 7.2.3
yubikey-manager 1.2.6
zoom 6.5.7.9933
39 packages installed.

Output Log

2025-07-24 11:42:34,307 8252 [DEBUG] - Process Tree: Chocolatey CLI => Chocolatey CLI => pwsh => explorer
2025-07-24 11:42:34,318 8252 [DEBUG] - Updating User Agent to 'Chocolatey Command Line/2.5.0 (Chocolatey CLI) via NuGet Client/6.4.1 (Microsoft Windows NT 10.0.26100.0)'.
2025-07-24 11:42:34,324 8252 [DEBUG] - Using proxy server 'http://PROXY:8080'.
2025-07-24 11:42:34,329 8252 [DEBUG] - Proxy has a bypass list of 'localhost,127.0.0.0/8,::1,10.0.0.0/8,192.168.0.0/16,.nwra.com'.
2025-07-24 11:42:34,355 8252 [DEBUG] - Source 'https://FQDN/repository/nuget-group/' is configured to bypass proxies.
2025-07-24 11:42:34,363 8252 [DEBUG] - Using configured certificate for source https://nwchoco.nwra.com/repository/nuget-group/
2025-07-24 11:42:34,369 8252 [WARN ] - Attempted to use a source name https://FQDN/repository/nuget-group/ to get default source but failed:
 Value cannot be null.
Parameter name: s

Additional Context

This still seem to work, but this error message makes it seem like it isn't.

[github-actions]

To vote for this issue, please add a 👍 emoji to the issue description. Votes in comments are not recorded.

[opoplawski]

If I drop --cert from the source I no longer get the message.

[vexx32]

That's probably important yeah, the --cert seems to be the key point here; we expect a --certpassword parameter to be passed as well, so when we try to import and use the certificate it can be decrypted appropriately.

I'm not sure if this requirement is documented or how else we'd expect a certificate file to be read, I'm not familiar with how the X509Certificate classes work. But we should probably check for the certificate password and use the appropriate constructor to retrieve the certificate if a password isn't provided.

@opoplawski given your source setup requires a certificate file, can you please provide more detailed instructions on how you configured your Nexus3 repository and generated the certificate, so we can appropriately test this scenario?

---

For the technical folks; the affected code area seems to be here:

choco/src/chocolatey/infrastructure.app/nuget/NugetCommon.cs

Lines 193 to 230 in e93875a

	if (!string.IsNullOrWhiteSpace(configuration.SourceCommand.Certificate))
	{
	"chocolatey".Log().Debug("Using passed in certificate for source {0}".FormatWith(source));
	sourceClientCertificates.Add(new X509Certificate2(configuration.SourceCommand.Certificate, configuration.SourceCommand.CertificatePassword));
	}
	if (configuration.MachineSources.Any(m => m.Name.IsEqualTo(source) || m.Key.IsEqualTo(source)))
	{
	try
	{
	var machineSource = configuration.MachineSources.FirstOrDefault(m => m.Key.IsEqualTo(source));
	if (machineSource == null)
	{
	machineSource = configuration.MachineSources.FirstOrDefault(m => m.Name.IsEqualTo(source));
	"chocolatey".Log().Debug("Switching source name {0} to actual source value '{1}'.".FormatWith(sourceValue, machineSource.Key.ToStringSafe()));
	source = machineSource.Key;
	}
	if (machineSource != null)
	{
	bypassProxy = machineSource.BypassProxy;
	if (bypassProxy)
	{
	"chocolatey".Log().Debug("Source '{0}' is configured to bypass proxies.".FormatWith(source));
	}
	if (!string.IsNullOrWhiteSpace(machineSource.Certificate))
	{
	"chocolatey".Log().Debug("Using configured certificate for source {0}".FormatWith(source));
	sourceClientCertificates.Add(new X509Certificate2(machineSource.Certificate, NugetEncryptionUtility.DecryptString(machineSource.EncryptedCertificatePassword)));
	}
	}
	}
	catch (Exception ex)
	{
	"chocolatey".Log().Warn("Attempted to use a source name {0} to get default source but failed:{1} {2}".FormatWith(sourceValue, System.Environment.NewLine, ex.Message));
	}
	}

We will need to understand this scenario more fully to be able to be sure what an appropriate fix would be before we go fixing this code, however.

[opoplawski]

We have the nexus repository behind an apache reverse proxy and are using a config like:

    SSLCACertificateFile /etc/pki/tls/certs/ad_ca.crt
    SSLVerifyClient require
    SSLVerifyDepth 1

We are issuing exportable computer certificates from our AD CA.

However, we have just recently abandoned this approach in favor of just using user authentication in the nexus repository so this really isn't needed by us anymore. Still wouldn't be a bad thing to fix though :)