{"id":"10093ab8897c7aa6","repo":"pallets/flask","slug":"cert-must-also-be-specified","errorCode":null,"errorMessage":"\"--cert\" must also be specified.","messagePattern":"\"--cert\" must also be specified\\.","errorType":"validation","errorClass":"click.BadParameter","httpStatus":null,"severity":"error","filePath":"src/flask/cli.py","lineNumber":856,"sourceCode":"        is_context = False\n    else:\n        is_context = isinstance(cert, ssl.SSLContext)\n\n    if value is not None:\n        if is_adhoc:\n            raise click.BadParameter(\n                'When \"--cert\" is \"adhoc\", \"--key\" is not used.', ctx, param\n            )\n\n        if is_context:\n            raise click.BadParameter(\n                'When \"--cert\" is an SSLContext object, \"--key\" is not used.',\n                ctx,\n                param,\n            )\n\n        if not cert:\n            raise click.BadParameter('\"--cert\" must also be specified.', ctx, param)\n\n        ctx.params[\"cert\"] = cert, value\n\n    else:\n        if cert and not (is_adhoc or is_context):\n            raise click.BadParameter('Required when using \"--cert\".', ctx, param)\n\n    return value\n\n\nclass SeparatedPathType(click.Path):\n    \"\"\"Click option type that accepts a list of values separated by the\n    OS's path separator (``:``, ``;`` on Windows). Each value is\n    validated as a :class:`click.Path` type.\n    \"\"\"\n\n    def convert(\n        self, value: t.Any, param: click.Parameter | None, ctx: click.Context | None","sourceCodeStart":838,"sourceCodeEnd":874,"githubUrl":"https://github.com/pallets/flask/blob/6a2f545bfd8ed31e19066a299296917e034aca58/src/flask/cli.py#L838-L874","documentation":"Raised by `_validate_key` when `--key` is given but `ctx.params.get('cert')` is empty/None. A private key alone cannot establish TLS — Flask needs the matching certificate — so the CLI rejects a lone `--key`. Note click processes `--cert` before `--key` (`is_eager=True` on cert), so this fires only when `--cert` was truly absent.","triggerScenarios":"`flask run --key key.pem` without any `--cert` option.","commonSituations":"Typo or partial deletion of the cert flag from a command; env-driven scripts where the cert variable expanded to empty (`--cert $CERT` with unset CERT can also mangle args); confusion thinking `--key` alone enables HTTPS.","solutions":["Add the certificate: `flask run --cert cert.pem --key key.pem`.","If you only wanted quick local HTTPS, use `flask run --cert adhoc` (no key needed).","Check that shell variables holding the cert path are actually set."],"exampleFix":"# before\nflask run --key key.pem\n# after\nflask run --cert cert.pem --key key.pem","handlingStrategy":"validation","validationCode":"if key is not None and cert is None:\n    raise SystemExit(\"--key requires --cert\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always specify --cert and --key as a pair in run scripts","Validate TLS argument pairs in wrapper scripts before exec'ing flask run","Keep cert/key paths in one config entry so one can't be set without the other"],"tags":["flask","cli","tls","configuration"],"analyzedSha":"6a2f545bfd8ed31e19066a299296917e034aca58","analyzedAt":"2026-07-31T19:13:49.921Z","schemaVersion":2}