HKUDS/DeepTutor · error · LLMConfigError

DISABLE_SSL_VERIFY is not allowed in production

Error message

DISABLE_SSL_VERIFY is not allowed in production

What it means

The OpenAI provider's constructor mirrors the production TLS guard: if the disable_ssl_verify setting is on and ENVIRONMENT is prod/production, it raises LLMConfigError instead of silently creating an httpx client with verify=False.

Source

Thrown at deeptutor/services/llm/providers/open_ai.py:63

    """Protocol for OpenAI streaming responses."""

    def __aiter__(self) -> AsyncIterator[OpenAIChunk]: ...


def _typed_track_llm_call(provider: str) -> Callable[[F], F]:
    return cast(Callable[[F], F], track_llm_call(provider))


@register_provider("openai")
class OpenAIProvider(BaseLLMProvider):
    """Production-ready OpenAI Provider with shared HTTP client."""

    def __init__(self, config: LLMConfig) -> None:
        super().__init__(config)
        http_client = None
        if load_system_settings()["disable_ssl_verify"]:
            if os.getenv("ENVIRONMENT", "").lower() in ("prod", "production"):
                raise LLMConfigError("DISABLE_SSL_VERIFY is not allowed in production")
            logger.warning("SSL verification disabled for OpenAI HTTP client")
            http_client = httpx.AsyncClient(verify=False)  # nosec B501
        self.client = openai.AsyncOpenAI(
            api_key=self.api_key,
            base_url=self.base_url or None,
            http_client=http_client,
        )

    @_typed_track_llm_call("openai")
    async def complete(self, prompt: str, **kwargs: object) -> TutorResponse:
        model_raw = kwargs.pop("model", None)
        model = model_raw if isinstance(model_raw, str) and model_raw else self.config.model
        if not model:
            raise LLMConfigError("Model not configured for OpenAI provider")
        kwargs.pop("stream", None)

        requested_max_tokens = (
            kwargs.pop("max_tokens", None)

View on GitHub (pinned to 3e82f13042)

Solutions

1. Turn disable_ssl_verify off in system settings and trust the proper CA bundle.
2. Add the corporate CA to the system trust store or use SSL_CERT_FILE.
3. Verify ENVIRONMENT is only 'production' in actual production.

Example fix

# before: settings {"disable_ssl_verify": true}, ENVIRONMENT=production
# after: settings {"disable_ssl_verify": false}

import os

def openai_provider_constructible() -> bool:
    return not (load_system_settings()['disable_ssl_verify']
                and os.getenv('ENVIRONMENT', '').lower() in ('prod', 'production'))

try:
    provider = OpenAIProvider(config)
except LLMConfigError as e:
    if 'DISABLE_SSL_VERIFY' in str(e):
        settings['disable_ssl_verify'] = False
        provider = OpenAIProvider(config)  # safe rebuild
    else:
        raise

When it happens

Trigger: Instantiating OpenAIProvider with disable_ssl_verify=true in system settings while ENVIRONMENT=prod|production — construction fails before any API call.

Common situations: Corporate-proxy self-signed-cert workaround promoted to production; ENVIRONMENT variable set globally to production on a dev box.

Related errors

• DISABLE_SSL_VERIFY is not allowed in production
• Invalid math animator config: {details}
• Invalid folder path
• Access denied
• OpenAI API error: {error_text}

AI-assisted analysis of HKUDS/DeepTutor@3e82f13042 (2026-08-27). Data as JSON: /api/errors/005aa95348814de9. Report an issue: GitHub.