using .der certificate in python/flask - python-3.x

Question

I have a python flask app where I created a cert and key file using ssl and put that in the code as follows
if __name__=='__main__':
context=('cert.crt','keys.key')
app.run('0.0.0.0',ssl_context=context,debug=True)
However they are not valid. In the server I have deployed the code there are 2 files 'sslca-chain.der' and 'SSLCA-Chain.pem'. How do I use that in the code instead of the above?

Answer 1

The two files you have mentioned are the same thing (chain certificates) just in different formats.
It is best to configure a reverse proxy (like nginx) to handle the SSL stuff rather than include it in your flask application.
Python only handles PEM format files natively.
However, if you must - you need two files - the certificate file, and the key file.
If you got your certificate from a third party CA, then they will provide you the certificate file.
The key file is always with you, and should be kept secret.
Since you have a certificate chain, you must provide a custom context to the application and include all the files in your chain, as the load_cert_chain method only takes one argument for the certificate file.
So, in short what you have to do is:
Make sure your PEM file contains your server certificate.
Create a custom context with the PEM file and your key file.
Pass this custom context to Flask
A PEM file is just a text file that contains all the certificates in a specific order; the order is:
-----BEGIN CERTIFICATE-----
(Your Primary SSL certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Intermediate certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Your Root certificate)
-----END CERTIFICATE-----
The -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines are important and should be included
Once you have verified that your PEM file contains your server certificate, here is how you would configure it for flask:
import ssl
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2) # use TLS to avoid POODLE
ctx.load_cert_chain('/path/to/sslca-chain.pem', '/path/to/server.key')
app.run('0.0.0.0',ssl_context=ctx,debug=True)