{"record":{"id":"6d1a62da2353b7f4","repo":"windmill-labs/windmill","slug":"failed-to-build-ai-http-client-check-system-tls","errorCode":null,"errorMessage":"Failed to build AI HTTP client - check system TLS configuration","messagePattern":"Failed to build AI HTTP client - check system TLS configuration","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/windmill-ai/src/utils.rs","lineNumber":35,"sourceCode":"    /// HTTP client for anything targeting a user-configured AI provider `base_url`;\n    /// use it instead of the shared `HTTP_CLIENT`. Redirects are governed by\n    /// `ALLOW_AI_BASE_URL_REDIRECTS` (disabled by default). Mirrors the API proxy\n    /// client (windmill-api/src/ai.rs).\n    ///\n    /// This pooled client does no DNS pinning: callers reaching a user-controlled\n    /// base_url must go through [`pinned_ai_client_for`] so the connect targets\n    /// the SSRF-validated address (DNS-rebinding TOCTOU). It is the safe default\n    /// only for trusted/fixed hosts.\n    pub static ref AI_HTTP_CLIENT: reqwest::Client = {\n        if *ALLOW_AI_BASE_URL_REDIRECTS {\n            tracing::warn!(\n                \"ALLOW_AI_BASE_URL_REDIRECTS is enabled - the AI HTTP client will follow \\\n                 redirects, weakening SSRF protection on provider base URLs\"\n            );\n        }\n        ai_http_client_builder()\n            .build()\n            .expect(\"Failed to build AI HTTP client - check system TLS configuration\")\n    };\n\n    /// Parse AI_HTTP_HEADERS environment variable into a vector of (header_name, header_value) tuples\n    /// Format: \"header1: value1, header2: value2\"\n    pub static ref AI_HTTP_HEADERS: Vec<(String, String)> = {\n        std::env::var(\"AI_HTTP_HEADERS\")\n            .ok()\n            .map(|headers_str| {\n                headers_str\n                    .split(',')\n                    .filter_map(|header| {\n                        let parts: Vec<&str> = header.splitn(2, ':').collect();\n                        if parts.len() == 2 {\n                            let name = parts[0].trim().to_string();\n                            let value = parts[1].trim().to_string();\n                            if !name.is_empty() && !value.is_empty() {\n                                Some((name, value))\n                            } else {","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/backend/windmill-ai/src/utils.rs#L17-L53","documentation":"Raised when building the pooled reqwest AI HTTP client fails at initialization — practically always a TLS backend problem (missing OpenSSL/rustls configuration, broken system certs). It is an environment/setup error on the host, not a request-time failure; the AI client static could not be constructed at all.","triggerScenarios":"Thrown at backend/windmill-ai/src/utils.rs:35 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Install/repair system CA certificates (e.g. ca-certificates package) on the host","Ensure OpenSSL libraries are present and version-compatible with the build","If behind a corporate proxy, configure proxy env vars and its CA cert appropriately"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}