diff --git a/src/mgmt/management-tool.cpp b/src/mgmt/management-tool.cpp
index 10e8aae..9925aca 100644
--- a/src/mgmt/management-tool.cpp
+++ b/src/mgmt/management-tool.cpp
@@ -334,6 +334,10 @@
   else
     data = ndn::io::load<ndn::Data>(inFile);
 
+  if (data == nullptr) {
+    throw Error("input does not contain a valid Data packet (is it in base64 format?)");
+  }
+
   //determine whether the data is a self-signed certificate
   shared_ptr<Regex> regex1 = make_shared<Regex>("(<>*)<KEY>(<>+)<ID-CERT><>");
   if (regex1->match(data->getName())) {
diff --git a/tests/unit/mgmt/management-tool.cpp b/tests/unit/mgmt/management-tool.cpp
index 49c33e7..3f18807 100644
--- a/tests/unit/mgmt/management-tool.cpp
+++ b/tests/unit/mgmt/management-tool.cpp
@@ -654,6 +654,21 @@
                                        dskCert->getName()));
 }
 
+BOOST_FIXTURE_TEST_CASE(AddRrSet6, ManagementToolFixture)
+{
+  //check using user provided certificate
+  Name parentZoneName("/ndns-test");
+  Name zoneName = Name(parentZoneName).append("child-zone");
+  m_tool.createZone(zoneName, parentZoneName);
+
+  //check invalid output
+  Name content = "invalid data packet";
+  std::string output = TEST_CERTDIR.string() + "/ss.cert";
+  ndn::io::save(content, output);
+
+  BOOST_CHECK_THROW(m_tool.addRrSet(zoneName, output), ndns::ManagementTool::Error);
+}
+
 BOOST_FIXTURE_TEST_CASE(ListAllZones, ManagementToolFixture)
 {
   m_tool.createZone(ROOT_ZONE, ROOT_ZONE, time::seconds(1), time::days(1), rootKsk, rootDsk);