{"record":{"id":"c4a0733c290d6345","repo":"Hmbown/CodeWhale","slug":"tls-certificate-verification-cannot-be-disabled-fo","errorCode":null,"errorMessage":"TLS certificate verification cannot be disabled for provider {}; configure SSL_CERT_FILE with a trusted custom CA bundle instead","messagePattern":"TLS certificate verification cannot be disabled for provider (.+?); configure SSL_CERT_FILE with a trusted custom CA bundle instead","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/client.rs","lineNumber":1136,"sourceCode":"        logging::info(format!(\n            \"API base URL: {}\",\n            redact_url_for_display(&base_url)\n        ));\n        if let Some(suffix) = &path_suffix {\n            logging::info(format!(\"API path suffix override: {suffix}\"));\n        }\n        if !http_headers.is_empty() {\n            logging::info(format!(\n                \"{} custom HTTP header(s) configured\",\n                http_headers.len()\n            ));\n        }\n        if insecure_skip_tls_verify {\n            logging::warn(format!(\n                \"TLS certificate verification cannot be disabled for provider {}; use SSL_CERT_FILE with a trusted custom CA bundle instead\",\n                api_provider.as_str()\n            ));\n            bail!(\n                \"TLS certificate verification cannot be disabled for provider {}; configure SSL_CERT_FILE with a trusted custom CA bundle instead\",\n                api_provider.as_str()\n            );\n        }\n        logging::info(format!(\n            \"Retry policy: enabled={}, max_retries={}, initial_delay={}s, max_delay={}s\",\n            retry.enabled, retry.max_retries, retry.initial_delay, retry.max_delay\n        ));\n        if let Some(limit) = request_concurrency_limit {\n            logging::info(format!(\n                \"Provider request concurrency cap: {} in-flight request(s)\",\n                limit\n            ));\n        }\n\n        let http_client = Self::build_http_client_with_auth_mode(\n            &api_key,\n            &http_headers,","sourceCodeStart":1118,"sourceCodeEnd":1154,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/client.rs#L1118-L1154","documentation":"A provider configuration requested insecure_skip_tls_verify, but this client intentionally ships no curl -k mode: disabling certificate verification would let a man-in-the-middle harvest the API key. It logs a warning naming the provider, then bails with the supported alternative — point SSL_CERT_FILE at a CA bundle that trusts your custom certificates.","triggerScenarios":"Setting insecure_skip_tls_verify = true on any provider config (the typical copy from a curl -k or verify=False workflow against a self-signed gateway); any code path that constructs the client with that flag enabled.","commonSituations":"Corporate TLS-intercepting proxies with a private root CA; local gateways serving self-signed certs; scripts migrated from curl or python requests where verification was disabled to 'make it work'.","solutions":["Export the trusted CA (or the self-signed leaf) to a PEM file and run SSL_CERT_FILE=/path/to/ca.pem codewhale.","Install the internal root CA into the system trust store so no env var is needed.","Serve the endpoint with a publicly trusted certificate (e.g. behind a normal ACME-issued cert)."],"exampleFix":"# before (config)\ninsecure_skip_tls_verify = true   # bails at client construction\n\n# after\nexport SSL_CERT_FILE=/etc/codewhale/corp-root-ca.pem\ncodewhale","handlingStrategy":"validation","validationCode":"if provider_config.insecure_skip_tls_verify {\n    anyhow::bail!(\n        \"insecure_skip_tls_verify is not supported; set SSL_CERT_FILE to your CA bundle\"\n    );\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never carry insecure_skip_tls_verify through config migrations.","Keep the internal root CA at a documented path and reference it via SSL_CERT_FILE.","Add a startup check that fails fast with CA instructions instead of failing at first request."],"tags":["rust","security","tls","self-signed-certificate","ssl-cert-file"],"backgroundTag":"insecure-tls-rejected","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}