pallets/flask · error · click.BadParameter

Required when using "--cert".

Error message

Required when using "--cert".

What it means

Raised by `_validate_key` when `--cert` points to a certificate file but no `--key` was supplied (`cert and not (is_adhoc or is_context)` with value None). A PEM certificate file does not include the private key as far as the dev server's flag contract is concerned, so both halves of the pair are required.

Source

Thrown at src/flask/cli.py:862

            raise click.BadParameter(
                'When "--cert" is "adhoc", "--key" is not used.', ctx, param
            )

        if is_context:
            raise click.BadParameter(
                'When "--cert" is an SSLContext object, "--key" is not used.',
                ctx,
                param,
            )

        if not cert:
            raise click.BadParameter('"--cert" must also be specified.', ctx, param)

        ctx.params["cert"] = cert, value

    else:
        if cert and not (is_adhoc or is_context):
            raise click.BadParameter('Required when using "--cert".', ctx, param)

    return value


class SeparatedPathType(click.Path):
    """Click option type that accepts a list of values separated by the
    OS's path separator (``:``, ``;`` on Windows). Each value is
    validated as a :class:`click.Path` type.
    """

    def convert(
        self, value: t.Any, param: click.Parameter | None, ctx: click.Context | None
    ) -> t.Any:
        items = self.split_envvar_value(value)
        # can't call no-arg super() inside list comprehension until Python 3.12
        super_convert = super().convert
        return [super_convert(item, param, ctx) for item in items]

View on GitHub ↗ (pinned to 6a2f545bfd)

Solutions

1. Provide the key file: `flask run --cert cert.pem --key key.pem`.
2. For throwaway local TLS, use `flask run --cert adhoc` instead.
3. If your cert and key live in one PEM, either split them or expose an `ssl.SSLContext` via `--cert module:ctx` with `load_cert_chain`.

Example fix

# before
flask run --cert cert.pem
# after
flask run --cert cert.pem --key key.pem

import pathlib
if cert and not isinstance(cert, str):
    pass  # adhoc/context need no key
elif cert and key is None:
    raise SystemExit("--cert with a file path requires --key")
elif key and not pathlib.Path(key).is_file():
    raise SystemExit(f"key file not found: {key}")

When it happens

Trigger: `flask run --cert cert.pem` with no `--key` option, where cert is a file path (not 'adhoc' and not an SSLContext import).

Common situations: Assuming a combined fullchain/key PEM works with `--cert` alone (Flask's CLI still requires the explicit `--key` flag); copying nginx-style config habits; forgetting the key path after generating certs with mkcert or openssl.

Related errors

• "--cert" must also be specified.
• Detected multiple Flask applications in module '{module.__na
• Detected factory '{attr_name}' in module '{module.__name__}'
• Failed to find Flask application or factory in module '{modu
• Failed to parse {app_name!r} as an attribute name or functio

AI-assisted analysis of pallets/flask@6a2f545bfd (2026-07-31). Data as JSON: /data/errors/cc14be8dca48e3b2.json. Report an issue: GitHub ↗.