Python Flask - Give https to Flask WebServer

Earlier, I briefly looked at how to use the Flask web server and how to use the domain name. This time I will see how to apply https.

Recently, it is recommended to use https instead of weak security http. And if you are providing important information through REST API, use of https is necessary to prevent this information from being leaked.

Let's Encrypt

Select Certbot from "With Shell Access" at https://letsencrypt.org/getting-started/.

On the CertBot page, select the web server and operating system.
The Flask we use is not included in the web server list. Therefore, select "None of the above". The operating system is the operating system of the device you connected the domain name to earlier. I am using CentOS7 but you can choose your operating system.

Now, looking at the bottom of the screen, it guides you through the appropriate installation method for the operating system and web server.
When using Flask on CentOS 7, you will be prompted to add the EPEL repository and then install certbot with the yum command. Proceed according to the screen contents.

yum install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
yum update
yum install certbot

And after the installation is completed, use the certbot command to generate the certificate.

Be Careful : Make sure to run the certbot command without any process using port 80. The port occupancy check can be done with the netstat -tnlp command.

certbot certonly --standalone

Then follow the on-screen instructions and enter the appropriate values. If it is done properly, you can see the following message.

Obtaining a new certificate
Performing the following challenges:
http-01 challenge for spypiggy.ga
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/spypiggy.ga/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/spypiggy.ga/privkey.pem
   Your cert will expire on 2020-10-06. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

You can see that the certificate file and key file are stored in the /etc/letsencrypt/live/spypiggy.ga/ directory. Now you can use these keys to provide https service.

It is very easy to use the certificate issued by Flask.
Just add the ssl_contex variable in the app.run function.

The following is the file that was first tested after installing Flask and changed to the https version.

from flask import Flask
import ssl
app = Flask(__name__)
IPADDR = '117.52.89.240'

@app.route('/')
def index():
    return 'Hello Flask'

@app.route('/info')
def info():
    return 'Info'


if __name__ == "__main__":
    ssl_ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
    ssl_ctx.load_cert_chain(certfile='/etc/letsencrypt/live/spypiggy.ga/fullchain.pem', keyfile='/etc/letsencrypt/live/spypiggy.ga/privkey.pem')
    app.run(host= IPADDR , port="8080", ssl_context=ssl_ctx)

<myhttps.py>

Now run the flask that supports https.

[root@gcloud-seoul pyflask]# python3 myhttps.py
 * Running on https://117.52.89.240:8080/ (Press CTRL+C to quit)

Then, access it using https in a web browser. You can also see that it works properly using https.