From 80a015f9212bcdcbcb4467911569adbb378e5a90 Mon Sep 17 00:00:00 2001 From: Nicole Rappe Date: Fri, 17 Oct 2025 23:15:56 -0600 Subject: [PATCH] Improve agent websocket TLS handling --- Data/Agent/agent.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/Data/Agent/agent.py b/Data/Agent/agent.py index 3a99f7b..8498f3b 100644 --- a/Data/Agent/agent.py +++ b/Data/Agent/agent.py @@ -540,12 +540,28 @@ class AgentHttpClient: engine = getattr(client, "eio", None) if engine is None: return - # python-engineio accepts bool, path, or ssl.SSLContext for ssl_verify + + # python-engineio accepts either a boolean or an ``ssl.SSLContext`` + # for TLS verification. When we have a pinned certificate bundle + # on disk, prefer constructing a dedicated context that trusts that + # bundle so WebSocket connections succeed even with private CAs. if isinstance(verify, str) and os.path.isfile(verify): - engine.ssl_verify = verify + try: + context = ssl.create_default_context(cafile=verify) + context.check_hostname = False + except Exception: + context = None + if context is not None: + engine.ssl_context = context + engine.ssl_verify = True + else: + engine.ssl_context = None + engine.ssl_verify = verify elif verify is False: + engine.ssl_context = None engine.ssl_verify = False else: + engine.ssl_context = None engine.ssl_verify = True except Exception: pass