mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-06 19:08:59 -05:00
[GH-ISSUE #1398] feat: CA truststore support #12479
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#12479
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @GillesBodart on GitHub (Apr 2, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/1398
Bug Report
Description
When you run the docker image in an enterprise context, based on the company policy, you may have SSL interception in order to anlyse the traffic
Bug Summary:
Impossible to add some CA to the internal trustore used to make the REST API request
Steps to Reproduce:
need to have SSL interception enable on your laptop that breaks the SSL chain
Expected Behavior:
Possibility to add CA to the used truststore
Actual Behavior:
CA can't be added
Environment
Reproduction Details
Confirmation:
Logs and Screenshots
Browser Console Logs:
{
"detail": "Something went wrong :/\nHTTPSConnectionPool(host='api.openai.com', port=443): Max retries exceeded with url: /v1/images/generations (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)')))"
}
Docker Container Logs:
INFO: 172.17.0.1:50270 - "GET /ollama/api/tags HTTP/1.1" 200 OK
INFO:apps.openai.main:get_all_models()
ERROR:apps.openai.main:Connection error: Cannot connect to host api.openai.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)')]
INFO:apps.openai.main:models: {'data': []}
INFO:apps.openai.main:get_all_models()
ERROR:apps.openai.main:Connection error: Cannot connect to host api.openai.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)')]
INFO:apps.openai.main:models: {'data': []}
INFO: 172.17.0.1:50270 - "GET /openai/api/models HTTP/1.1" 200 OK
INFO: 172.17.0.1:50270 - "GET /litellm/api/v1/models HTTP/1.1" 200 OK
INFO: 172.17.0.1:50294 - "GET /_app/immutable/nodes/8.0396dff0.js HTTP/1.1" 200 OK
INFO: 172.17.0.1:50298 - "GET /ollama/api/version HTTP/1.1" 200 OK
INFO: 172.17.0.1:50304 - "GET /ollama/api/version HTTP/1.1" 200 OK
INFO: 172.17.0.1:50304 - "GET /ollama/urls HTTP/1.1" 200 OK
INFO: 172.17.0.1:50304 - "GET /ollama/api/version HTTP/1.1" 200 OK
INFO: 172.17.0.1:50304 - "GET /litellm/api/model/info HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /api/config HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /api/v1/auths/ HTTP/1.1" 200 OK
INFO:apps.ollama.main:get_all_models()
INFO: 172.17.0.1:50316 - "GET /ollama/api/tags HTTP/1.1" 200 OK
INFO:apps.openai.main:get_all_models()
ERROR:apps.openai.main:Connection error: Cannot connect to host api.openai.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)')]
INFO:apps.openai.main:models: {'data': []}
INFO:apps.openai.main:get_all_models()
ERROR:apps.openai.main:Connection error: Cannot connect to host api.openai.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)')]
INFO:apps.openai.main:models: {'data': []}
INFO: 172.17.0.1:50316 - "GET /openai/api/models HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /litellm/api/v1/models HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /api/v1/modelfiles/ HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /api/v1/prompts/ HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /api/v1/documents/ HTTP/1.1" 200 OK
INFO: 172.17.0.1:50316 - "GET /api/v1/chats/tags/all HTTP/1.1" 200 OK
INFO:apps.ollama.main:get_all_models()
Screenshots (if applicable):
Installation Method
Docker vanilla install with Open API key
Additional Information
[Include any additional details that may help in understanding and reproducing the issue. This could include specific configurations, error messages, or anything else relevant to the bug.]
Note
If the bug report is incomplete or does not follow the provided instructions, it may not be addressed. Please ensure that you have followed the steps outlined in the README.md and troubleshooting.md documents, and provide all necessary information for us to reproduce and address the issue. Thank you!
@strikeoncmputrz commented on GitHub (Apr 4, 2024):
This would be an excellent feature. I'd rather not have to run my openai compatible inference server in http mode but I'm using a private public key infrastructure
@tjbck commented on GitHub (Apr 14, 2024):
Feel free to make a PR!
@theobjectivedad commented on GitHub (Jun 19, 2024):
For folks stuck on this, here is a quick hack you can use ... basically you can just map
/etc/ssl/certs/ca-certificates.crtin the container to a another file that contains your own trust chain.In this example, I have my internal root CA trusted on the host machine and can map it directly into the container (don't forget to make it read only just in case):
For a larger-scale deployment you can basically do the same thing, ex in Kubernetes maybe you are using something like trust-manager to manage your truststore within the cluster. You can mount the trust-manager managed bundle to
/etc/ssl/certs/ca-certificates.crtinside the open webui pod.This isn't a best practice and and environment variable configuration to add an additional truststore would be cleaner but this will work in the interim. As an aside, I tried to set
REQUESTS_CA_BUNDLEin the environment but it didn't work for me.@hanahige commented on GitHub (Jul 16, 2024):
I'm not able to get the fix above to work, I've pulled my CA bundle from my AD Domain and added it into the container as mentioned above, however I still get a SSL: CERTIFICATE_VERIFY_FAILED error.
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)however I did notice that the above method allows me to curl the .well-known address without having to ignore validation. It just seems like Open WebUI doesn't also respect that the CA root for my domain is trusted once added to the container CA trust.
I'm running Open WebUI 0.3.7, and Authentik 2024.4.7 behind a NGINX reverse proxy.
@KizzyCode commented on GitHub (Jul 30, 2024):
FWIW, you can force python to use the system certificate store via
REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crtin the environment.My (trimmed down) docker-compose.yml looks like this:
where
/etc/containers/openwebui/compusrv.crtis simply my self-signed certificate (i.e. you don't even need to build a full truststore, if you don't want to).@nomppy commented on GitHub (Jul 30, 2024):
As an alternative to what @KizzyCode said and @theobjectivedad said about setting the
REQUESTS_CA_BUNDLEenv + mounting the host store, you can also add the following commands in the Dockerfilebtw, I also have set
Note that if you're building with the Dockerfile, you will also need to add the cert for the frontend
buildstage@christiangierschner commented on GitHub (Aug 6, 2024):
Sadly, this does not work for me...
i still get SSL: CERTIFICATE_VERIFY_FAILED if i hit "Continue with OAuth2" on login screen
however if i exec into the container, this works:
seems like webui is somehow not using the rootca
any ideas?
@nomppy commented on GitHub (Aug 6, 2024):
What does your compose file look like?
@christiangierschner commented on GitHub (Aug 7, 2024):
@nomppy commented on GitHub (Aug 7, 2024):
Is
/usr/local/share/ca-certificates/roocat.crtthe complete CA used by your system. If it's just your custom root CA, then you are not giving python any of the usual certs usually present in /etc/ssl/certs/ca-certificates.crt.Can you try
update-ca-certificateson your host and then mapping/etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro?@christiangierschner commented on GitHub (Aug 9, 2024):
i tried both...none works
our hosts all have our rootca implmented with
update-ca-certificatesi get Internal Server Error and SSL: CERTIFICATE_VERIFY_FAILED
@nomppy commented on GitHub (Aug 9, 2024):
/etcssl/certs/ca-certificates.crtcontains the cert in rootca.crt?rootca.crt?@bkev commented on GitHub (Aug 10, 2024):
After struggling with this myself, thanks for the pointers in here.
What fixed this for me was
I copied the root.crt (from Caddy) to my Linux device and put it in /usr/local/share/ca-certificates
I then ran sudo update-ca-certificates which said it had added one cert.
After playing about, the only options that seemed to work me for me was adding these to my docker run command
-v /link/to/my/cert.crt:/etc/ssl/certs/ca-certificates.crt:ro
AND
-e REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
After that, the Openweb-ui accepted the connections and it worked.
@christiangierschner commented on GitHub (Aug 12, 2024):
Yes, it contains the cert.
I got it from our rootca server and we use it in all our servers and deployments via ansible. It works.
I only get the error, when i click on login with OAuth. Open-webui then connects to our internal keycloak secured with a signed cert from our rootca.
@ebakoba commented on GitHub (Aug 14, 2024):
@christiangierschner and all the future people struggling with OAuth and custom CA certs.
It was able to deduce from the logs that OAuth does not use
requestsas its client module, buthttpxinstead.httpxdocumentation explains that custom CA certs could be used by using environment variableSSL_CERT_FILE. I was able to resolve my cert issue by adding:to docker compose.
@idling-mind commented on GitHub (Feb 6, 2025):
I had similar problem in testing OWUI in an enterprise setting. What ever I tried, I was unable to connect to openai's api end points. This is what finally fixed my issue. If this looks like a useful solution, i'd be happy to create a pull request.
open_webui/routers/openai.pyand added the following in the start.Then where ever I found a
session.getorsession.requestI addedssl=ssl_context.2. set the env variable
SSL_CERT_FILEto/etc/ssl/certs/ca-bundle.crtNow I'm able to connect to openai api endpoints.