Skip to content

tls

TLS helpers shared by MADA HTTP clients.

This module centralizes certificate verification behavior so MCP HTTP tools and OpenAI-compatible model clients resolve CA bundles the same way.

resolve_httpx_verify_value(*, verify=True)

Return the verify value to pass to httpx2 clients.

Explicit verify values other than True are returned unchanged. Resolution order for verify=True is:

  1. SSL_CERT_FILE
  2. REQUESTS_CA_BUNDLE
  3. System trust store via truststore
Source code in src/mada/core/tls.py 
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
def resolve_httpx_verify_value(
    *, verify: bool | ssl.SSLContext | str = True
) -> bool | ssl.SSLContext | str:
    """
    Return the verify value to pass to ``httpx2`` clients.

    Explicit ``verify`` values other than ``True`` are returned unchanged.
    Resolution order for ``verify=True`` is:

    1. ``SSL_CERT_FILE``
    2. ``REQUESTS_CA_BUNDLE``
    3. System trust store via ``truststore``
    """
    if verify is not True:
        return verify

    for env_var in ("SSL_CERT_FILE", "REQUESTS_CA_BUNDLE"):
        cert_path = os.getenv(env_var)
        if not cert_path:
            continue
        if os.path.exists(cert_path):
            return cert_path
        LOG.warning(
            "Ignoring %s=%r because the file does not exist.", env_var, cert_path
        )

    return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)