flask extension for doing TLS client cert authentication
Latest commit a751251 Nov 21, 2014 stf [fix] missing readme from manifest
Failed to load latest commit information.
demo [enh] adopted to tlsauth 0.3 Apr 3, 2013
flask_tlsauth [fix] fix Apr 3, 2013
MANIFEST.in [fix] missing readme from manifest Nov 21, 2014
README.org [doc] updated Apr 3, 2013
setup.py [fix] missing readme from manifest Nov 21, 2014



Flask-TLSAuth integrates a minimal certificate authority (CA) and implements TLS client certificate authentication. It depends on nginx for handling the TLS authentication part.


pip install flask_tlsauth

Flask-TLSAuth depends on tlsauth which provides minimal tools to act as a CA. Please follow the “CA and https service install” steps from https://github.com/stef/tlsauth to set up your webserver and CA.

tlsauth decorator

Flask-TLSAuth provides a simple decorator to guard your entry points:

from flask import Flask, Response, redirect
import os
app = Flask(__name__)
app.secret_key = 'some secret randomness'

# we need a CA
from tlsauth import CertAuthority
import flask_tlsauth as tlsauth

# previously we setup up the CA according to the tlsauth doc

adminOs=['CA admins']
# grants admin access to anyone with a
# valid cert asserting membership in "CA admins"
tlsauth.tlsauth_init(app, ca, groups=adminOs)

def unauth():
    return redirect("/")


# lets protect this valuable function,
# redirecting unauthorized visitors to /
@tlsauth.tlsauth(unauth=unauth, groups=adminOs)
def hello():
    return Response("hello world")

Managing certs

Flask-TLSAuth provides a few default routes to manage the certs and the CA.


Visitors can register like on a normal site, but when done, they get a PKCS12 certificate ready to be saved and imported in all browsers. This is totally automatic and there’s no check if the specified organization is not a privileged one (like “CA admins” in the above example). This really provides no security, for bots and scripts it’s even easier to use these certs than for normal humans. Other mechanisms must be deployed to provide meaningful authentication.


Visitors can submit their Certificate Signing Request (can be easily generated using gencert.sh from tlsauth), which depending on configuration either returns automatically a signed certificate (no meaningful authentication this way, avoid this!), or it gets stored for later approval by the “CA admins”.


Returns the CA root certificate in PEM format, for import into your browser.


Displays a list of incoming CSRs to any certified member of the “CA admin” group. The certs can be either rejected or signed, in the later case the resulting certificate is sent to the email address of the subject.


Displays whether you are TLS authenticated and what your distinguished name is.