diff --git a/src/main/java/com/cisd/tms/modules/cert/service/CertificateService.java b/src/main/java/com/cisd/tms/modules/cert/service/CertificateService.java
index 6807848..cc0fc72 100644
--- a/src/main/java/com/cisd/tms/modules/cert/service/CertificateService.java
+++ b/src/main/java/com/cisd/tms/modules/cert/service/CertificateService.java
@@ -19,6 +19,7 @@ import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.StringUtils;
 import org.springframework.web.multipart.MultipartFile;
 
+import java.io.IOException;
 import java.security.cert.X509Certificate;
 import java.time.LocalDateTime;
 import java.time.ZoneId;
@@ -60,13 +61,26 @@ public class CertificateService {
         result.setRecords(page.getRecords().stream().map(this::toItem).toList());
         return result;
     }
-
     @Transactional
     public ImportCertificateResponse importCertificate(MultipartFile file) {
-        try {
-            //todo file空值判断
+        if ( null == file || file.isEmpty() || file.getSize() < 1) {
+            throw new BizException(ErrorCode.BAD_REQUEST.getCode(), "证书文件为空");
+        }
 
-            X509Certificate certificate = CertPemSupport.parseCertificate(file.getBytes());
+        byte[] data = null;
+        try {
+            data = file.getBytes();
+        } catch (IOException e) {
+            throw new BizException(ErrorCode.BAD_REQUEST.getCode(), "证书文件读取时 IO 异常");
+        }
+
+        return importCertificate(data);
+    }
+
+    @Transactional
+    public ImportCertificateResponse importCertificate(byte[] fileData) {
+        try {
+            X509Certificate certificate = CertPemSupport.parseCertificate(fileData);
             // 终端证书入库前先固定 PKI 边界：只接受当前有效、非 CA、用途满足业务认证的实体/用户证书。
             assertValidTime(certificate);
             assertEndEntityCertificate(certificate);
diff --git a/src/main/java/com/cisd/tms/modules/cert/service/TrustedCertService.java b/src/main/java/com/cisd/tms/modules/cert/service/TrustedCertService.java
index 7f1a7a2..b9385a0 100644
--- a/src/main/java/com/cisd/tms/modules/cert/service/TrustedCertService.java
+++ b/src/main/java/com/cisd/tms/modules/cert/service/TrustedCertService.java
@@ -21,6 +21,7 @@ import org.springframework.transaction.annotation.Transactional;
 import org.springframework.util.StringUtils;
 import org.springframework.web.multipart.MultipartFile;
 
+import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.security.Security;
 import java.security.cert.X509CRL;
@@ -83,8 +84,24 @@ public class TrustedCertService {
 
     @Transactional
     public ImportCertificateResponse importTrusted(MultipartFile file, String alias) {
+        if ( null == file || file.isEmpty() || file.getSize() < 1) {
+            throw new BizException(ErrorCode.BAD_REQUEST.getCode(), "证书文件为空");
+        }
+
+        byte[] data = null;
         try {
-            X509Certificate certificate = CertPemSupport.parseCertificate(file.getBytes());
+            data = file.getBytes();
+        } catch (IOException e) {
+            throw new BizException(ErrorCode.BAD_REQUEST.getCode(), "证书文件读取时 IO 异常");
+        }
+
+        return importTrusted(data, alias);
+    }
+
+    @Transactional
+    public ImportCertificateResponse importTrusted(byte[] fileData, String alias) {
+        try {
+            X509Certificate certificate = CertPemSupport.parseCertificate(fileData);
             // 可信库只保存 CA 证书；终端证书必须走 CertificateService，避免信任锚和业务证书混用。
             assertValidTime(certificate);
             assertTrustedCaCertificate(certificate);