pallets/flask · error · click.BadParameter

"--cert" must also be specified.

Error message

"--cert" must also be specified.

What it means

Raised by `_validate_key` when `--key` is given but `ctx.params.get('cert')` is empty/None. A private key alone cannot establish TLS — Flask needs the matching certificate — so the CLI rejects a lone `--key`. Note click processes `--cert` before `--key` (`is_eager=True` on cert), so this fires only when `--cert` was truly absent.

Source

Thrown at src/flask/cli.py:856

        is_context = False
    else:
        is_context = isinstance(cert, ssl.SSLContext)

    if value is not None:
        if is_adhoc:
            raise click.BadParameter(
                'When "--cert" is "adhoc", "--key" is not used.', ctx, param
            )

        if is_context:
            raise click.BadParameter(
                'When "--cert" is an SSLContext object, "--key" is not used.',
                ctx,
                param,
            )

        if not cert:
            raise click.BadParameter('"--cert" must also be specified.', ctx, param)

        ctx.params["cert"] = cert, value

    else:
        if cert and not (is_adhoc or is_context):
            raise click.BadParameter('Required when using "--cert".', ctx, param)

    return value


class SeparatedPathType(click.Path):
    """Click option type that accepts a list of values separated by the
    OS's path separator (``:``, ``;`` on Windows). Each value is
    validated as a :class:`click.Path` type.
    """

    def convert(
        self, value: t.Any, param: click.Parameter | None, ctx: click.Context | None

View on GitHub ↗ (pinned to 6a2f545bfd)

Solutions

1. Add the certificate: `flask run --cert cert.pem --key key.pem`.
2. If you only wanted quick local HTTPS, use `flask run --cert adhoc` (no key needed).
3. Check that shell variables holding the cert path are actually set.

Example fix

# before
flask run --key key.pem
# after
flask run --cert cert.pem --key key.pem

if key is not None and cert is None:
    raise SystemExit("--key requires --cert")

When it happens

Trigger: `flask run --key key.pem` without any `--cert` option.

Common situations: Typo or partial deletion of the cert flag from a command; env-driven scripts where the cert variable expanded to empty (`--cert $CERT` with unset CERT can also mangle args); confusion thinking `--key` alone enables HTTPS.

Related errors

• Required when using "--cert".
• Detected multiple Flask applications in module '{module.__na
• Detected factory '{attr_name}' in module '{module.__name__}'
• Failed to find Flask application or factory in module '{modu
• Failed to parse {app_name!r} as an attribute name or functio

AI-assisted analysis of pallets/flask@6a2f545bfd (2026-07-31). Data as JSON: /data/errors/10093ab8897c7aa6.json. Report an issue: GitHub ↗.