app.tls

The TLS context shared by every outbound HTTPS client.

The OIDC discovery request and the GitLab client (httpx) and the JWKS fetch (PyJWT) all use the ssl.SSLContext built here, so they trust exactly the same certificate authorities.

Trust store, with verification on (ADRIANO_TLS_VERIFY, the default):

  • Base: the Mozilla bundle shipped with certifi. When the SSL_CERT_FILE environment variable is set, that file replaces it; otherwise, when SSL_CERT_DIR is set, that directory replaces it. This is the precedence httpx itself applies, so setting either variable keeps its documented “replace the standard set” meaning.

  • Extra CAs (ADRIANO_EXTRA_CA_CERTS): every certificate in the configured PEM files (bundles allowed) and in the *.pem and *.crt files of the configured directories is added on top of the base, so public endpoints keep working. Each file is parsed with cryptography first; an unreadable file, a file without a PEM certificate or a directory without matching files raises ConfigurationError naming it. The added certificates are logged at INFO with their subjects.

With verification off the context checks neither certificates nor host names, and the extra CAs are ignored; one warning says so.

outbound_ssl_context() is cached per argument pair, so a process builds each context (and logs about it) once. Processes build it at startup (app.cli.main(), app.main.create_app()) so a bad CA file stops them instead of failing the first login or poll.

Public API: outbound_ssl_context(), ssl_context_from_settings(), unverified_ssl_context().

app.tls.outbound_ssl_context(verify=True, extra_ca_certs=())

Build (once per arguments) the context for outbound HTTPS.

Parameters:

  • verify (bool) – Whether to verify server certificates and host names (ADRIANO_TLS_VERIFY).

  • extra_ca_certs (tuple[Path, ...]) – PEM files and directories whose certificates are trusted in addition to the base store (ADRIANO_EXTRA_CA_CERTS); ignored when verify is false.

Return type:

SSLContext

Returns:

The shared context; callers must not modify it.

Raises:

ConfigurationError – If an extra CA path cannot be loaded.

app.tls.ssl_context_from_settings(settings)

Return the outbound context for the application settings.

Parameters:

settings (Settings) – Application settings.

Return type:

SSLContext

Returns:

The shared context (see outbound_ssl_context()).

Raises:

ConfigurationError – If an extra CA path cannot be loaded.

app.tls.unverified_ssl_context()

Build a TLS context that skips certificate and hostname checks.

Used only when ADRIANO_TLS_VERIFY is false.

Return type:

SSLContext

Returns:

The context.