AWS EC2 Flask后端迁移HTTPS遇阻，需实现与React前端SSL连接

Hey there, let's troubleshoot why SSLify isn't doing its job for your Flask app on EC2. You've got valid Let's Encrypt certs, but the HTTPS migration isn't sticking—here are the most common fixes to try:

1. Make Sure Flask is Actually Serving HTTPS #

SSLify only enforces redirects from HTTP to HTTPS, but it can't do anything if your Flask app isn't configured to serve HTTPS in the first place.

If you're using Flask's built-in dev server (only for testing!), add the SSL context to your app.run() call with your Let's Encrypt cert paths:

if __name__ == '__main__':
    app.run(
        host='0.0.0.0',
        port=443,
        ssl_context=('/etc/letsencrypt/live/your-domain.com/fullchain.pem', '/etc/letsencrypt/live/your-domain.com/privkey.pem')
    )

Note: Never use Flask's dev server in production. Use Gunicorn, uWSGI, or pair with Nginx instead (more on that later).

2. Configure SSLify to Trust Proxy Headers #

If you're using a reverse proxy (like Nginx or AWS ELB) in front of Flask, SSLify won't detect the actual HTTPS request by default—because Flask only sees the HTTP traffic from the proxy.

Fix this by enabling proxy header support in SSLify:

sslify = SSLify(app, proxy_headers=True)

This tells SSLify to look for the X-Forwarded-Proto header that proxies send to indicate the original request protocol (HTTPS).

3. Verify Cert Permissions & Paths #

Double-check that your Flask process can access the Let's Encrypt cert files:

• Use absolute paths for your certs (avoid relative paths, which can break depending on where you run the app).
• Ensure the files have read permissions for the user running Flask (e.g., ec2-user or www-data). Run these commands to fix permissions:

  sudo chmod 644 /etc/letsencrypt/live/your-domain.com/fullchain.pem
  sudo chmod 644 /etc/letsencrypt/live/your-domain.com/privkey.pem
  

4. Check EC2 Security Group Rules #

Don't overlook the basics:

• Open port 443 (HTTPS) to allow incoming traffic from your desired sources (e.g., 0.0.0.0/0 for public access).
• Open port 80 (HTTP) too—this is where SSLify will receive requests to redirect to HTTPS.

5. Production-Grade Setup (Recommended) #

For production, using Nginx as a reverse proxy is far more stable and secure than running Flask directly with SSL. Here's a quick setup:

Step 1: Configure Nginx #

Create or edit your Nginx config (usually at /etc/nginx/sites-available/your-domain.com):

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name your-domain.com;
    return 301 https://$host$request_uri;
}

# Serve HTTPS with Let's Encrypt certs
server {
    listen 443 ssl;
    server_name your-domain.com;

    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;

    # Pass requests to Flask (running on Gunicorn at 127.0.0.1:8000)
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the config and restart Nginx:

sudo ln -s /etc/nginx/sites-available/your-domain.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl restart nginx

Step 2: Run Flask with Gunicorn #

Install Gunicorn and run your app:

pip install gunicorn
gunicorn --bind 127.0.0.1:8000 app:app

With this setup, Nginx handles all SSL termination, and SSLify will work correctly because it sees the X-Forwarded-Proto header from Nginx.

6. Disable Debug Mode Override #

SSLify automatically disables itself when Flask's debug mode is set to True. If you're testing and want SSLify to work in debug mode, force it:

sslify = SSLify(app, debug=True)

Again, never run debug mode in production.

Test It Out #

Use curl to check if redirects are working:

curl -I http://your-domain.com

You should see a 301 Moved Permanently response pointing to the HTTPS version of your site.

内容的提问来源于stack exchange，提问作者Brody Higby