{"id":"8ec645f1544096d2","repo":"pallets/flask","slug":"using-ad-hoc-certificates-requires-the-cryptograph","errorCode":null,"errorMessage":"Using ad-hoc certificates requires the cryptography library.","messagePattern":"Using ad-hoc certificates requires the cryptography library\\.","errorType":"validation","errorClass":"click.BadParameter","httpStatus":null,"severity":"error","filePath":"src/flask/cli.py","lineNumber":812,"sourceCode":"        try:\n            import ssl\n        except ImportError:\n            raise click.BadParameter(\n                'Using \"--cert\" requires Python to be compiled with SSL support.',\n                ctx,\n                param,\n            ) from None\n\n        try:\n            return self.path_type(value, param, ctx)\n        except click.BadParameter:\n            value = click.STRING(value, param, ctx).lower()  # type: ignore[union-attr]\n\n            if value == \"adhoc\":\n                try:\n                    import cryptography  # noqa: F401\n                except ImportError:\n                    raise click.BadParameter(\n                        \"Using ad-hoc certificates requires the cryptography library.\",\n                        ctx,\n                        param,\n                    ) from None\n\n                return value\n\n            obj = import_string(value, silent=True)\n\n            if isinstance(obj, ssl.SSLContext):\n                return obj\n\n            raise\n\n\ndef _validate_key(ctx: click.Context, param: click.Parameter, value: t.Any) -> t.Any:\n    \"\"\"The ``--key`` option must be specified when ``--cert`` is a file.\n    Modifies the ``cert`` param to be a ``(cert, key)`` pair if needed.","sourceCodeStart":794,"sourceCodeEnd":830,"githubUrl":"https://github.com/pallets/flask/blob/6a2f545bfd8ed31e19066a299296917e034aca58/src/flask/cli.py#L794-L830","documentation":"A click.BadParameter raised by `CertParamType.convert` when `--cert=adhoc` is requested but `import cryptography` fails. Ad-hoc mode asks Werkzeug to generate a temporary self-signed certificate on the fly, which requires the optional `cryptography` package; a file-based `--cert` does not need it.","triggerScenarios":"`flask run --cert=adhoc` in an environment without the cryptography package installed. The check fires only for the literal value `adhoc` (case-insensitive), after the value fails to resolve as an existing file path.","commonSituations":"Quick local HTTPS testing following tutorial commands without installing extras; slim Docker/CI environments with only core dependencies; cryptography missing wheels on unusual platforms so the install was skipped.","solutions":["Install the package: `pip install cryptography`, then rerun `flask run --cert=adhoc`.","Alternatively generate a real self-signed cert once and pass files instead: `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes` then `flask run --cert=cert.pem --key=key.pem`.","For production-like HTTPS, use mkcert or a reverse proxy rather than ad-hoc certificates."],"exampleFix":"# before\nflask run --cert=adhoc   # cryptography not installed\n# after\npip install cryptography\nflask run --cert=adhoc","handlingStrategy":"validation","validationCode":"import importlib.util\nif importlib.util.find_spec(\"cryptography\") is None:\n    raise SystemExit(\"pip install cryptography before using --cert adhoc\")","typeGuard":null,"tryCatchPattern":"try:\n    run_command(cert=\"adhoc\")\nexcept click.BadParameter:\n    print(\"Install 'cryptography' or pass real cert/key files instead of adhoc\", file=sys.stderr)\n    sys.exit(2)","preventionTips":["Add cryptography as a dev dependency if the team uses 'flask run --cert adhoc'","Prefer mkcert-generated local certificates over adhoc — stable, browser-trusted, and no extra runtime dependency","Keep adhoc certs strictly for local development; production TLS belongs at the proxy layer"],"tags":["flask","cli","ssl","https","dependencies"],"analyzedSha":"6a2f545bfd8ed31e19066a299296917e034aca58","analyzedAt":"2026-07-31T19:13:49.921Z","schemaVersion":2}