The idea to put Apache in front of your application and have Apache handle the HTTPS is a good one. I would personally reach for NGINX over Apache, but it's the same difference.

Here are some resources concerning this:

• https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-uswgi-and-nginx-on-ubuntu-18-04

• https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-18-04

Why? (quote from the docs):

At the time of the release of Waitress, there are already many pure-Python WSGI servers. Why would we need another?

Waitress is meant to be useful to web framework authors who require broad platform support. It’s neither the fastest nor the fanciest WSGI server available but using it helps eliminate the N-by-M documentation burden (e.g. production vs. deployment, Windows vs. Unix, Python 3 vs. Python 2, PyPy vs. CPython) and resulting user confusion imposed by spotty platform support of the current (2012-ish) crop of WSGI servers. For example, gunicorn is great, but doesn’t run on Windows. paste.httpserver is perfectly serviceable, but doesn’t run under Python 3 and has no dedicated tests suite that would allow someone who did a Python 3 port to know it worked after a port was completed. wsgiref works fine under most any Python, but it’s a little slow and it’s not recommended for production use as it’s single-threaded and has not been audited for security issues.

At the time of this writing, some existing WSGI servers already claim wide platform support and have serviceable test suites. The CherryPy WSGI server, for example, targets Python 2 and Python 3 and it can run on UNIX or Windows. However, it is not distributed separately from its eponymous web framework, and requiring a non-CherryPy web framework to depend on the CherryPy web framework distribution simply for its server component is awkward. The test suite of the CherryPy server also depends on the CherryPy web framework, so even if we forked its server component into a separate distribution, we would have still needed to backfill for all of its tests. The CherryPy team has started work on Cheroot, which should solve this problem, however.

Waitress is a fork of the WSGI-related components which existed in zope.server. zope.server had passable framework-independent test coverage out of the box, and a good bit more coverage was added during the fork. zope.server has existed in one form or another since about 2001, and has seen production usage since then, so Waitress is not exactly “another” server, it’s more a repackaging of an old one that was already known to work fairly well.

OK, looks like I got it figured out:

In my manage.py file:

from OpenSSL  import SSL
context = ('app/host-2.cert', 'app/host-2.key')
:
manager.add_command('runserver', Server('localhost', port=5000, **ssl_**context=context))

I did try this last night but using context instead of ssl_context: manager.add_command('runserver', Server('localhost', port=5000, context=context))

So that explains why it was failing for me. Anyway, I've answered the question, hopefully this thread will help someone in the future.

This appears to be related to how the requests module validates certificates rather than anything to do with Python/your server. See:

http://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification

You may want to double-check your use of the cert keyword arg. Specifically, make sure the path is correct and make sure that, if your cert file doesn't include the key, you are passing a tuple with paths to both the cert and key.

Unfortunately, I can't speak to #2.