SSL：EE_KEY_TOO_SMALLの解決方法

ソースコードのディレクトリツリー

$ tree
.
├── hello.py
├── server.crt
└── server.key

hello.py

from flask import Flask
app = Flask(__name__)

@app.route('/')
def hello():
    return 'hello'

if __name__ == '__main__':
    app.run(host='127.0.0.1', port=5000, ssl_context=('server.crt', 'server.key'))

起動時のエラー報告

$ python3 hello.py 
 * Serving Flask app "hello" (lazy loading)
 * Environment: production
   WARNING: This is a development server. Do not use it in a production deployment.
   Use a production WSGI server instead.
 Use a production WSGI server instead. * Debug mode: off
Traceback (most recent call last):
  File "hello.py", line 9, in <module>
    app.run(host='127.0.0.1', port=5000, ssl_context=('server.crt', 'server.key'))
  File "/home/liyongjun/.local/lib/python3.8/site-packages/flask/app.py", line 990, in run
    run_simple(host, port, self, **options)
  File "/home/liyongjun/.local/lib/python3.8/site-packages/werkzeug/serving.py", line 1052, in run_simple
    inner()
  File "/home/liyongjun/.local/lib/python3.8/site-packages/werkzeug/serving.py", line 996, in inner
    srv = make_server(
  File "/home/liyongjun/.local/lib/python3.8/site-packages/werkzeug/serving.py", line 847, in make_server
    return ThreadedWSGIServer(
  File "/home/liyongjun/.local/lib/python3.8/site-packages/werkzeug/serving.py", line 766, in __init__
    self.socket = ssl_context.wrap_socket(sock, server_side=True)
  File "/home/liyongjun/.local/lib/python3.8/site-packages/werkzeug/serving.py", line 656, in wrap_socket
    return ssl.wrap_socket(
  File "/usr/lib/python3.8/ssl.py", line 1402, in wrap_socket
    context.load_cert_chain(certfile, keyfile)
ssl.SSLError: [SSL: EE_KEY_TOO_SMALL] ee key too small (_ssl.c:4022)

使用されている秘密鍵が短すぎることが原因です。1024ビット以上の鍵が必要です。ここでは、2048ビットの鍵と証明書を再生成します。

# Generate a private key : server.key
openssl genrsa -des3 -out server.key 2048

# Generate a CSR : server.csr
openssl req -new -key server.key -out server.csr

# Remove Passphrase from key : server.key.org , server.crt
cp server.key server.key.org
openssl rsa -in server.key.org -out server.key

# Generate self signed certificate: server.crt
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

上記の秘密鍵と証明書のファイルを置き換えるだけです
もう一度実行してください。

$ python3 hello.py 
 * Serving Flask app "hello" (lazy loading)
 * Environment: production
   WARNING: This is a development server. Do not use it in a production deployment.
   Use a production WSGI server instead.
 Use a production WSGI server instead. * Debug mode: off
 * Running on https://127.0.0.1:5000/ (Press CTRL+C to quit)

アクセスに成功しました。