{"id":"cc14be8dca48e3b2","repo":"pallets/flask","slug":"required-when-using-cert","errorCode":null,"errorMessage":"Required when using \"--cert\".","messagePattern":"Required when using \"--cert\"\\.","errorType":"validation","errorClass":"click.BadParameter","httpStatus":null,"severity":"error","filePath":"src/flask/cli.py","lineNumber":862,"sourceCode":"            raise click.BadParameter(\n                'When \"--cert\" is \"adhoc\", \"--key\" is not used.', ctx, param\n            )\n\n        if is_context:\n            raise click.BadParameter(\n                'When \"--cert\" is an SSLContext object, \"--key\" is not used.',\n                ctx,\n                param,\n            )\n\n        if not cert:\n            raise click.BadParameter('\"--cert\" must also be specified.', ctx, param)\n\n        ctx.params[\"cert\"] = cert, value\n\n    else:\n        if cert and not (is_adhoc or is_context):\n            raise click.BadParameter('Required when using \"--cert\".', ctx, param)\n\n    return value\n\n\nclass SeparatedPathType(click.Path):\n    \"\"\"Click option type that accepts a list of values separated by the\n    OS's path separator (``:``, ``;`` on Windows). Each value is\n    validated as a :class:`click.Path` type.\n    \"\"\"\n\n    def convert(\n        self, value: t.Any, param: click.Parameter | None, ctx: click.Context | None\n    ) -> t.Any:\n        items = self.split_envvar_value(value)\n        # can't call no-arg super() inside list comprehension until Python 3.12\n        super_convert = super().convert\n        return [super_convert(item, param, ctx) for item in items]\n","sourceCodeStart":844,"sourceCodeEnd":880,"githubUrl":"https://github.com/pallets/flask/blob/6a2f545bfd8ed31e19066a299296917e034aca58/src/flask/cli.py#L844-L880","documentation":"Raised by `_validate_key` when `--cert` points to a certificate file but no `--key` was supplied (`cert and not (is_adhoc or is_context)` with value None). A PEM certificate file does not include the private key as far as the dev server's flag contract is concerned, so both halves of the pair are required.","triggerScenarios":"`flask run --cert cert.pem` with no `--key` option, where cert is a file path (not 'adhoc' and not an SSLContext import).","commonSituations":"Assuming a combined fullchain/key PEM works with `--cert` alone (Flask's CLI still requires the explicit `--key` flag); copying nginx-style config habits; forgetting the key path after generating certs with mkcert or openssl.","solutions":["Provide the key file: `flask run --cert cert.pem --key key.pem`.","For throwaway local TLS, use `flask run --cert adhoc` instead.","If your cert and key live in one PEM, either split them or expose an `ssl.SSLContext` via `--cert module:ctx` with `load_cert_chain`."],"exampleFix":"# before\nflask run --cert cert.pem\n# after\nflask run --cert cert.pem --key key.pem","handlingStrategy":"validation","validationCode":"import pathlib\nif cert and not isinstance(cert, str):\n    pass  # adhoc/context need no key\nelif cert and key is None:\n    raise SystemExit(\"--cert with a file path requires --key\")\nelif key and not pathlib.Path(key).is_file():\n    raise SystemExit(f\"key file not found: {key}\")","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When --cert is a certificate file, always supply the matching --key file","Check both files exist and are readable before launching the server","Store cert and key paths together in deployment config and validate them as a unit"],"tags":["flask","cli","tls","configuration"],"analyzedSha":"6a2f545bfd8ed31e19066a299296917e034aca58","analyzedAt":"2026-07-31T19:13:49.921Z","schemaVersion":2}