{"id":"dd1b1082fc630df6","repo":"pallets/flask","slug":"using-cert-requires-python-to-be-compiled-with","errorCode":null,"errorMessage":"Using \"--cert\" requires Python to be compiled with SSL support.","messagePattern":"Using \"--cert\" requires Python to be compiled with SSL support\\.","errorType":"validation","errorClass":"click.BadParameter","httpStatus":null,"severity":"error","filePath":"src/flask/cli.py","lineNumber":797,"sourceCode":"\nclass CertParamType(click.ParamType):  # type: ignore[type-arg]\n    \"\"\"Click option type for the ``--cert`` option. Allows either an\n    existing file, the string ``'adhoc'``, or an import for a\n    :class:`~ssl.SSLContext` object.\n    \"\"\"\n\n    name = \"path\"\n\n    def __init__(self) -> None:\n        self.path_type = click.Path(exists=True, dir_okay=False, resolve_path=True)\n\n    def convert(\n        self, value: t.Any, param: click.Parameter | None, ctx: click.Context | None\n    ) -> t.Any:\n        try:\n            import ssl\n        except ImportError:\n            raise click.BadParameter(\n                'Using \"--cert\" requires Python to be compiled with SSL support.',\n                ctx,\n                param,\n            ) from None\n\n        try:\n            return self.path_type(value, param, ctx)\n        except click.BadParameter:\n            value = click.STRING(value, param, ctx).lower()  # type: ignore[union-attr]\n\n            if value == \"adhoc\":\n                try:\n                    import cryptography  # noqa: F401\n                except ImportError:\n                    raise click.BadParameter(\n                        \"Using ad-hoc certificates requires the cryptography library.\",\n                        ctx,\n                        param,","sourceCodeStart":779,"sourceCodeEnd":815,"githubUrl":"https://github.com/pallets/flask/blob/6a2f545bfd8ed31e19066a299296917e034aca58/src/flask/cli.py#L779-L815","documentation":"A click.BadParameter raised by `CertParamType.convert` when `--cert` is used but `import ssl` fails. The `ssl` module is part of the standard library only when the Python interpreter was built against OpenSSL headers; without it Flask's dev server cannot serve HTTPS at all, so any `--cert` value is rejected up front.","triggerScenarios":"`flask run --cert=cert.pem` (or `--cert=adhoc`) under a Python interpreter compiled without SSL support — typically a from-source build where libssl-dev/openssl-devel headers were absent at compile time.","commonSituations":"Custom-compiled Python (pyenv, `make install`) on a machine missing OpenSSL dev headers; minimal container base images or embedded/stripped Python distributions; broken conda/OpenSSL linkage after system upgrades.","solutions":["Verify the interpreter: `python -c 'import ssl'` — if it fails, install OpenSSL dev headers (`apt install libssl-dev` / `dnf install openssl-devel`) and rebuild/reinstall Python (e.g. `pyenv install 3.12`).","Switch to a distribution Python or official docker image that ships with ssl support.","If you can't fix the interpreter, run without --cert and terminate TLS in a reverse proxy (nginx/caddy) in front of the app."],"exampleFix":"# before\nflask run --cert=adhoc   # Python built without ssl\n# after\nsudo apt install libssl-dev && pyenv install 3.12 && pyenv local 3.12\nflask run --cert=adhoc","handlingStrategy":"validation","validationCode":"import importlib.util\nif importlib.util.find_spec(\"ssl\") is None:\n    raise SystemExit(\"This Python lacks SSL support; use a Python built with OpenSSL or terminate TLS at a reverse proxy\")","typeGuard":"def python_has_ssl():\n    try:\n        import ssl  # noqa: F401\n        return True\n    except ImportError:\n        return False","tryCatchPattern":"try:\n    ctx = _validate_cert_key(ctx, param, value)\nexcept click.BadParameter as e:\n    print(f\"--cert unusable: {e.message}\", file=sys.stderr)\n    sys.exit(2)","preventionTips":["Use an official/distribution Python build — SSL-less interpreters usually come from source builds missing OpenSSL headers","Check once per environment with python -c \"import ssl\" before relying on --cert","In production terminate TLS at nginx/Caddy instead of the dev server's --cert"],"tags":["flask","cli","ssl","https","python-build"],"analyzedSha":"6a2f545bfd8ed31e19066a299296917e034aca58","analyzedAt":"2026-07-31T19:13:49.921Z","schemaVersion":2}