Skip to content

feat: Update proxy implementation and add SSL configuration#48

Open
anmaslov wants to merge 1 commit into
fuergaosi233:mainfrom
anmaslov:main
Open

feat: Update proxy implementation and add SSL configuration#48
anmaslov wants to merge 1 commit into
fuergaosi233:mainfrom
anmaslov:main

Conversation

@anmaslov
Copy link
Copy Markdown

This PR adds SSL configuration options to address certificate verification issues when connecting to downstream APIs. The changes allow users to configure SSL behavior through environment variables, which is particularly useful when working with corporate firewalls, proxies, or self-signed certificates.

Summary of Changes:

  • Added SSL_VERIFY environment variable to enable/disable SSL certificate verification (defaults to true)
  • Added CA_BUNDLE_PATH environment variable to specify custom CA bundle for SSL verification
  • Updated the OpenAI client to use custom SSL context based on these configuration options
  • Added a new /ssl-config endpoint to check current SSL configuration
  • Updated README with documentation about SSL configuration options and troubleshooting
  • Added a test file test_ssl_config.py to verify SSL configuration handling

Environment Variables:

  • SSL_VERIFY: Enable/disable SSL certificate verification (default: true)
  • CA_BUNDLE_PATH: Path to custom CA bundle for SSL verification (optional)

These changes should resolve SSL certificate errors like CERTIFICATE_VERIFY_FAILED that users may encounter in certain network environments.

@fuergaosi233
Copy link
Copy Markdown
Owner

Why do we need to add this feature? Ordinary users may not need this 🤔

slovx2 pushed a commit to slovx2/claude-code-proxy that referenced this pull request Oct 21, 2025
Add Docker support, multi-platform CI
aaaronmiller added a commit to aaaronmiller/claude-code-proxy that referenced this pull request May 18, 2026
Three changes addressing the deferred bypass-alias task + diagnosing the
silent cldo OAuth failure mode the user reported.

1. New profiles + aliases (Task fuergaosi233#48):
   profiles/profiles.json adds 'pi-bypass' and 'hermes-bypass' — no
   force_main (caller's main model passes through unchanged), tool calls
   forced to a 4-model owl-alpha cascade:
     openrouter/owl-alpha       (verified agentic tool-call model)
     minimax/minimax-m2.5:free  (fast fallback, different provider)
     nvidia/nemotron-3-super    (third provider for diversity)
     qwen/qwen3-next-80b        (final fallback)
   web_search inherits from default (nemotron-nano).

   Four new aliases in install-aliases.sh:
     psi-bp / psi-bp-c     — pi with bypass profile
     hsi-bp / hsr-bp       — hermes with bypass profile
   All route via /p/{profile-name}/v1/* so headroom + RTK still apply.

2. Auth method logging at INFO (Task fuergaosi233#49):
   The cldo failure was hard to diagnose because the proxy's "is OAuth
   token being forwarded?" decision only logged at DEBUG. Now every
   request emits ONE info-line:
     [rid] auth: passthrough Anthropic-OAuth  →  routed-model
     [rid] auth: server-key (sk-or-v1-...)    →  routed-model
     [rid] auth: server-key (proxy mode, EMPTY)  →  routed-model
     [rid] auth: NO KEY (will 401)            →  routed-model
   This single line tells you whether the client's OAuth token was used,
   or the proxy silently fell back to its server key, or no key existed.

3. cldo guard (Task fuergaosi233#50):
   Empty $CLAUDE_CODE_OAUTH_TOKEN now triggers a yellow warning before
   the proxy call, telling the user to set the token + where to find it,
   and confirming the fallback (server PROVIDERS_anthropic_API_KEY) is
   what will be used. Previously this was silent.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@jiafeimao0p
Copy link
Copy Markdown

SSL 配置问题可以检查:

  1. 确认上游 API 证书是否有效(是否过期)
  2. 尝试 SSL_CERT_FILE 环境变量指定自定义 CA 证书
  3. 如果是自签名证书,关闭 SSL verify(测试环境)

不想折腾证书配置?1API (ctoai.xyz) 提供已经配置好的 SSL,直接调用即可,新用户免费额度。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants