Hmbown/CodeWhale · error · anyhow::Error

TLS certificate verification cannot be disabled for provider

Error message

TLS certificate verification cannot be disabled for provider {}; configure SSL_CERT_FILE with a trusted custom CA bundle instead

What it means

A provider configuration requested insecure_skip_tls_verify, but this client intentionally ships no curl -k mode: disabling certificate verification would let a man-in-the-middle harvest the API key. It logs a warning naming the provider, then bails with the supported alternative — point SSL_CERT_FILE at a CA bundle that trusts your custom certificates.

Source

Thrown at crates/tui/src/client.rs:1136

        logging::info(format!(
            "API base URL: {}",
            redact_url_for_display(&base_url)
        ));
        if let Some(suffix) = &path_suffix {
            logging::info(format!("API path suffix override: {suffix}"));
        }
        if !http_headers.is_empty() {
            logging::info(format!(
                "{} custom HTTP header(s) configured",
                http_headers.len()
            ));
        }
        if insecure_skip_tls_verify {
            logging::warn(format!(
                "TLS certificate verification cannot be disabled for provider {}; use SSL_CERT_FILE with a trusted custom CA bundle instead",
                api_provider.as_str()
            ));
            bail!(
                "TLS certificate verification cannot be disabled for provider {}; configure SSL_CERT_FILE with a trusted custom CA bundle instead",
                api_provider.as_str()
            );
        }
        logging::info(format!(
            "Retry policy: enabled={}, max_retries={}, initial_delay={}s, max_delay={}s",
            retry.enabled, retry.max_retries, retry.initial_delay, retry.max_delay
        ));
        if let Some(limit) = request_concurrency_limit {
            logging::info(format!(
                "Provider request concurrency cap: {} in-flight request(s)",
                limit
            ));
        }

        let http_client = Self::build_http_client_with_auth_mode(
            &api_key,
            &http_headers,

View on GitHub (pinned to 0c42157ee5)

Solutions

Export the trusted CA (or the self-signed leaf) to a PEM file and run SSL_CERT_FILE=/path/to/ca.pem codewhale.
Install the internal root CA into the system trust store so no env var is needed.
Serve the endpoint with a publicly trusted certificate (e.g. behind a normal ACME-issued cert).

Example fix

# before (config)
insecure_skip_tls_verify = true   # bails at client construction

# after
export SSL_CERT_FILE=/etc/codewhale/corp-root-ca.pem
codewhale

Defensive patterns

Strategy: validation

Validate before calling

if provider_config.insecure_skip_tls_verify {
    anyhow::bail!(
        "insecure_skip_tls_verify is not supported; set SSL_CERT_FILE to your CA bundle"
    );
}

Prevention

Never carry insecure_skip_tls_verify through config migrations.
Keep the internal root CA at a documented path and reference it via SSL_CERT_FILE.
Add a startup check that fails fast with CA instructions instead of failing at first request.

When it happens

Trigger: Setting insecure_skip_tls_verify = true on any provider config (the typical copy from a curl -k or verify=False workflow against a self-signed gateway); any code path that constructs the client with that flag enabled.

Common situations: Corporate TLS-intercepting proxies with a private root CA; local gateways serving self-signed certs; scripts migrated from curl or python requests where verification was disabled to 'make it work'.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/c4a0733c290d6345. Report an issue: GitHub.