What causes "DISABLE_SSL_VERIFY is not allowed in production" in HKUDS/DeepTutor?

Set disable_ssl_verify back to false in data/user/settings and install the CA cert properly.

HKUDS/DeepTutor · error · LLMConfigError

DISABLE_SSL_VERIFY is not allowed in production

Error message

DISABLE_SSL_VERIFY is not allowed in production

What it means

disable_ssl_verify_enabled() reads the DISABLE_SSL_VERIFY system setting; when it is enabled AND ENVIRONMENT is 'prod'/'production', it raises LLMConfigError as a hard safety guard against shipping with TLS verification off.

Source

Thrown at deeptutor/services/llm/openai_http_client.py:26

from typing import Any

import httpx

from deeptutor.services.config import load_system_settings
from deeptutor.services.llm.exceptions import LLMConfigError

logger = logging.getLogger(__name__)

_warning_lock = threading.Lock()
_warning_logged = False


def disable_ssl_verify_enabled() -> bool:
    """Return whether outbound TLS verification should be disabled."""
    if not load_system_settings()["disable_ssl_verify"]:
        return False
    if os.getenv("ENVIRONMENT", "").strip().lower() in {"prod", "production"}:
        raise LLMConfigError("DISABLE_SSL_VERIFY is not allowed in production")
    global _warning_logged
    with _warning_lock:
        if not _warning_logged:
            logger.warning(
                "SSL verification is disabled via DISABLE_SSL_VERIFY. This is unsafe "
                "and must not be used in production environments."
            )
            _warning_logged = True
    return True


_sanitized_lock = threading.Lock()
_sanitized_warned: set[str] = set()

# httpx passes these OpenSSL paths to ssl.create_default_context, which raises
# FileNotFoundError when a path has gone stale after a conda env is cloned or
# moved without ca-certificates.
_SSL_CA_ENV_PATHS: tuple[tuple[str, str], ...] = (

View on GitHub (pinned to 3e82f13042)

Solutions

Set disable_ssl_verify back to false in data/user/settings and install the CA cert properly.
If TLS interception is genuinely needed in prod, terminate it at a trusted proxy instead.
Ensure ENVIRONMENT isn't accidentally set to production in dev.

Example fix

# before
{"disable_ssl_verify": true}
# after
{"disable_ssl_verify": false}

Defensive patterns

Strategy: validation

Validate before calling

import os

def ssl_config_safe() -> bool:
    return not (os.getenv('ENVIRONMENT', '').lower() in ('prod', 'production')) or not load_system_settings()['disable_ssl_verify']

Try / catch

try:
    client = build_openai_http_client()
except LLMConfigError as e:
    if 'DISABLE_SSL_VERIFY' in str(e):
        settings['disable_ssl_verify'] = False  # persist fix, then rebuild

Prevention

Add a CI check asserting disable_ssl_verify=false when ENVIRONMENT=production
Use SSL_CERT_FILE/REQUESTS_CA_BUNDLE for corporate CAs instead of disabling verification
Never copy dev settings JSON into prod images

When it happens

Trigger: System settings have disable_ssl_verify=true and the ENVIRONMENT env var equals 'prod' or 'production' (case-insensitive, whitespace-trimmed); any embed/build_openai_http_client/_call_codex call then fails.

Common situations: A dev-only self-signed-cert workaround accidentally promoted to production config; CI pipelines setting ENVIRONMENT=production while reusing dev settings JSON.

Related errors

AI-assisted analysis of HKUDS/DeepTutor@3e82f13042 (2026-08-27). Data as JSON: /api/errors/5fe9c250533e0f97. Report an issue: GitHub.