{"id":"b142bf36b3f6f78f","repo":"pallets/flask","slug":"when-cert-is-adhoc-key-is-not-used","errorCode":null,"errorMessage":"When \"--cert\" is \"adhoc\", \"--key\" is not used.","messagePattern":"When \"--cert\" is \"adhoc\", \"--key\" is not used\\.","errorType":"validation","errorClass":"click.BadParameter","httpStatus":null,"severity":"error","filePath":"src/flask/cli.py","lineNumber":844,"sourceCode":"\n\ndef _validate_key(ctx: click.Context, param: click.Parameter, value: t.Any) -> t.Any:\n    \"\"\"The ``--key`` option must be specified when ``--cert`` is a file.\n    Modifies the ``cert`` param to be a ``(cert, key)`` pair if needed.\n    \"\"\"\n    cert = ctx.params.get(\"cert\")\n    is_adhoc = cert == \"adhoc\"\n\n    try:\n        import ssl\n    except ImportError:\n        is_context = False\n    else:\n        is_context = isinstance(cert, ssl.SSLContext)\n\n    if value is not None:\n        if is_adhoc:\n            raise click.BadParameter(\n                'When \"--cert\" is \"adhoc\", \"--key\" is not used.', ctx, param\n            )\n\n        if is_context:\n            raise click.BadParameter(\n                'When \"--cert\" is an SSLContext object, \"--key\" is not used.',\n                ctx,\n                param,\n            )\n\n        if not cert:\n            raise click.BadParameter('\"--cert\" must also be specified.', ctx, param)\n\n        ctx.params[\"cert\"] = cert, value\n\n    else:\n        if cert and not (is_adhoc or is_context):\n            raise click.BadParameter('Required when using \"--cert\".', ctx, param)","sourceCodeStart":826,"sourceCodeEnd":862,"githubUrl":"https://github.com/pallets/flask/blob/6a2f545bfd8ed31e19066a299296917e034aca58/src/flask/cli.py#L826-L862","documentation":"Raised by Flask's CLI (`_validate_key` in src/flask/cli.py) as a click.BadParameter when `flask run --cert adhoc --key <file>` is used. Adhoc mode generates a self-signed certificate and key on the fly via pyOpenSSL, so a user-supplied private key is contradictory and Flask fails fast rather than silently ignoring it.","triggerScenarios":"Running `flask run --cert adhoc --key path/to/key.pem`. The `--key` callback checks `ctx.params.get('cert') == 'adhoc'` and rejects any non-None key value.","commonSituations":"Copying an HTTPS run command that used real cert files and swapping in `adhoc` for quick local TLS while forgetting to delete `--key`; shell scripts or Makefiles that always append `--key` regardless of cert mode.","solutions":["Remove the `--key` option: `flask run --cert adhoc`.","If you actually want to use your own cert/key pair, replace `adhoc` with the certificate file path: `flask run --cert cert.pem --key key.pem`.","Ensure pyOpenSSL is installed for adhoc mode (`pip install pyopenssl`)."],"exampleFix":"# before\nflask run --cert adhoc --key key.pem\n# after\nflask run --cert adhoc","handlingStrategy":"validation","validationCode":"# before invoking `flask run`\nif cert == \"adhoc\" and key is not None:\n    raise SystemExit(\"Do not pass --key when --cert=adhoc\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat --cert adhoc as a complete TLS spec; never pair it with --key","In launch scripts, build CLI args from a single tls config object so cert/key combinations are validated in one place","Use ssl_context='adhoc' in app.run() instead of mixing CLI flags when scripting"],"tags":["flask","cli","tls","ssl","dev-server"],"analyzedSha":"6a2f545bfd8ed31e19066a299296917e034aca58","analyzedAt":"2026-07-31T19:13:49.921Z","schemaVersion":2}