Certificate Management Service:Install an SSL certificate on Python Flask (Linux)

Check whether port 443 is open

Run the following command to check port 443 status. Replace <your_server_public_ip> with your server's public IP address.

RHEL/CentOS

command -v nc > /dev/null 2>&1 || sudo yum install -y nc
# Replace <your_server_public_ip> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l 443 & sleep 1; nc -w 3 -vz <your_server_public_ip> 443

If port 443 is open, the output looks like:

Ncat: Connected to <your_server_public_ip>:443

Debian/Ubuntu

command -v nc > /dev/null 2>&1 || sudo apt-get install -y netcat
# Replace <your_server_public_ip> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l -p 443 & sleep 1; nc -w 3 -vz <your_server_public_ip> 443

If port 443 is open, the output looks like:

Connection to <your_server_public_ip> port [tcp/https] succeeded!

or

[<your_server_public_ip>] 443 (https) open

If port 443 is not open, complete the next two steps to open it.

Open port 443 in the security group

Go to the ECS instances page and click the target instance to open its details page. In the Security Group Details section, add a security group rule with the following settings:

Open port 443 in the firewall

Run the following command to identify the active firewall service:

if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    echo "firewalld"
elif command -v ufw >/dev/null 2>&1 && sudo ufw status | grep -qw active; then
    echo "ufw"
elif command -v nft >/dev/null 2>&1 && sudo nft list ruleset 2>/dev/null | grep -q 'table'; then
    echo "nftables"
elif command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet iptables; then
    echo "iptables"
elif command -v iptables >/dev/null 2>&1 && sudo iptables -L 2>/dev/null | grep -qE 'REJECT|DROP|ACCEPT'; then
    echo "iptables"
else
    echo "none"
fi

If the output is none, no further action is needed. Otherwise, run the corresponding command below to open port 443.

firewalld

sudo firewall-cmd --permanent --add-port=443/tcp && sudo firewall-cmd --reload

ufw

sudo ufw allow 443/tcp

nftables

sudo nft add table inet filter 2>/dev/null
sudo nft add chain inet filter input '{ type filter hook input priority 0; }' 2>/dev/null
sudo nft add rule inet filter input tcp dport 443 counter accept 2>/dev/null

iptables

sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

To persist iptables rules across reboots:

• RHEL/CentOS:

  sudo yum install -y iptables-services
  sudo service iptables save

• Debian/Ubuntu:

  sudo apt-get install -y iptables-persistent
  sudo iptables-save | sudo tee /etc/iptables/rules.v4 >/dev/null

Check the certificate in a browser

Open https://yourdomain in a browser (replace yourdomain with your actual domain). A lock icon in the address bar confirms the certificate is deployed correctly.

Starting from version 117, the icon in Chrome has been replaced with . Click this icon to view the certificate details.

If the lock icon does not appear or you get an access error, clear your browser cache or try again in incognito mode.

If the issue persists, see Resolve certificate deployment issues based on browser error messages and SSL certificate deployment troubleshooting guide.

Why is HTTPS inaccessible after installing or updating the certificate?

This is usually caused by one of the following. Check them in order:

• Port 443 is blocked: The security group or firewall does not allow traffic on port 443. See Step 2: Configure the system and network environment.

• Domain mismatch: The domain you're accessing is not listed in the certificate's Bound Domains. See the domain name matching rules in Prerequisites.

• Flask not restarted: Restart Flask after modifying the application file.

• Incorrect certificate path: Verify that the .pem and .key file paths in ssl_context are correct and that you're using the latest, valid certificate files.

• Missing certificate on other services: If your domain uses a Content Delivery Network (CDN), Server Load Balancer (SLB), or Web Application Firewall (WAF), install the certificate on those services as well. See Certificate deployment locations when traffic passes through multiple Alibaba Cloud services.

• Partial deployment across multiple servers: If your domain's DNS resolves to multiple servers, install the certificate on all of them.

How do I update or replace an installed certificate?

1. Back up the existing .pem and .key files on your server.

2. Download the new certificate and private key files from your Certificate Management Service console.

3. Upload the new files to your server, overwriting the old ones. Keep the same file paths and names as specified in your Flask configuration.

4. Restart Flask to apply the new certificate.

Flask throws FileNotFoundError on startup

This error means the file path in ssl_context is wrong. Check if the paths for the certificate and private key files provided in ssl_context are correct. Paths should be relative to the directory where you run the python <your-app-file>.py command, or you should use absolute paths.

The browser shows ERR_SSL_PROTOCOL_ERROR or resets the connection

Check the following:

• The certificate file and private key file match each other.

• The certificate file is a complete certificate chain (usually a .pem file). Certificate files downloaded from Alibaba Cloud already include the full chain.

• The security group and firewall allow inbound traffic on port 443.