{"record":{"id":"005aa95348814de9","repo":"HKUDS/DeepTutor","slug":"disable-ssl-verify-is-not-allowed-in-production-005aa9","errorCode":null,"errorMessage":"DISABLE_SSL_VERIFY is not allowed in production","messagePattern":"DISABLE_SSL_VERIFY is not allowed in production","errorType":"validation","errorClass":"LLMConfigError","httpStatus":null,"severity":"error","filePath":"deeptutor/services/llm/providers/open_ai.py","lineNumber":63,"sourceCode":"    \"\"\"Protocol for OpenAI streaming responses.\"\"\"\n\n    def __aiter__(self) -> AsyncIterator[OpenAIChunk]: ...\n\n\ndef _typed_track_llm_call(provider: str) -> Callable[[F], F]:\n    return cast(Callable[[F], F], track_llm_call(provider))\n\n\n@register_provider(\"openai\")\nclass OpenAIProvider(BaseLLMProvider):\n    \"\"\"Production-ready OpenAI Provider with shared HTTP client.\"\"\"\n\n    def __init__(self, config: LLMConfig) -> None:\n        super().__init__(config)\n        http_client = None\n        if load_system_settings()[\"disable_ssl_verify\"]:\n            if os.getenv(\"ENVIRONMENT\", \"\").lower() in (\"prod\", \"production\"):\n                raise LLMConfigError(\"DISABLE_SSL_VERIFY is not allowed in production\")\n            logger.warning(\"SSL verification disabled for OpenAI HTTP client\")\n            http_client = httpx.AsyncClient(verify=False)  # nosec B501\n        self.client = openai.AsyncOpenAI(\n            api_key=self.api_key,\n            base_url=self.base_url or None,\n            http_client=http_client,\n        )\n\n    @_typed_track_llm_call(\"openai\")\n    async def complete(self, prompt: str, **kwargs: object) -> TutorResponse:\n        model_raw = kwargs.pop(\"model\", None)\n        model = model_raw if isinstance(model_raw, str) and model_raw else self.config.model\n        if not model:\n            raise LLMConfigError(\"Model not configured for OpenAI provider\")\n        kwargs.pop(\"stream\", None)\n\n        requested_max_tokens = (\n            kwargs.pop(\"max_tokens\", None)","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/HKUDS/DeepTutor/blob/3e82f130422a813cdd73c10b21a44e9325f5821a/deeptutor/services/llm/providers/open_ai.py#L45-L81","documentation":"The OpenAI provider's constructor mirrors the production TLS guard: if the disable_ssl_verify setting is on and ENVIRONMENT is prod/production, it raises LLMConfigError instead of silently creating an httpx client with verify=False.","triggerScenarios":"Instantiating OpenAIProvider with disable_ssl_verify=true in system settings while ENVIRONMENT=prod|production — construction fails before any API call.","commonSituations":"Corporate-proxy self-signed-cert workaround promoted to production; ENVIRONMENT variable set globally to production on a dev box.","solutions":["Turn disable_ssl_verify off in system settings and trust the proper CA bundle.","Add the corporate CA to the system trust store or use SSL_CERT_FILE.","Verify ENVIRONMENT is only 'production' in actual production."],"exampleFix":"# before: settings {\"disable_ssl_verify\": true}, ENVIRONMENT=production\n# after: settings {\"disable_ssl_verify\": false}","handlingStrategy":"validation","validationCode":"import os\n\ndef openai_provider_constructible() -> bool:\n    return not (load_system_settings()['disable_ssl_verify']\n                and os.getenv('ENVIRONMENT', '').lower() in ('prod', 'production'))","typeGuard":null,"tryCatchPattern":"try:\n    provider = OpenAIProvider(config)\nexcept LLMConfigError as e:\n    if 'DISABLE_SSL_VERIFY' in str(e):\n        settings['disable_ssl_verify'] = False\n        provider = OpenAIProvider(config)  # safe rebuild\n    else:\n        raise","preventionTips":["Gate deploys on a config lint that rejects disable_ssl_verify in prod","Use trusted CA bundles for intercepting proxies","Set ENVIRONMENT explicitly per deployment, not globally"],"tags":["ssl","security","openai","production-guard"],"backgroundTag":"ssl-verification-disabled","analyzedSha":"3e82f130422a813cdd73c10b21a44e9325f5821a","analyzedAt":"2026-08-27T06:57:25.364Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}