Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #2409] [FEAT]: custom HTTPS certificate for Azure OpenAI #1565

New Issue
Closed
opened 2026-02-22 18:25:26 -05:00 by yindo · 3 comments
yindo commented 2026-02-22 18:25:26 -05:00
Owner
Copy Link
Copy Source

Originally created by @tech92yc on GitHub (Oct 2, 2024).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/2409

What would you like to see?

My organization uses a custom endpoints with https enabled, but uses a internally signed certificate (custom root CA)
let's suppose the company name is ACME and the domain is acme.com
the AzureOpenAI endpoint is https://llm.acme.com , however the connection fails from AnythingLLM because of the https certificate being custom . In our python code we add a directive :

os.environ['REQUESTS_CA_BUNDLE'] = 'ca-bundle-full.crt'
openai.api_type = 'azure'
openai.api_version = "2023-03-15-preview"
openai.api_base = os.getenv("BASE_URL")
openai.api_key = os.getenv("OPENAIAPI_KEY")

Is there any way to support this with anythingLLM?

Originally created by @tech92yc on GitHub (Oct 2, 2024). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/2409 ### What would you like to see? My organization uses a custom endpoints with https enabled, but uses a internally signed certificate (custom root CA) let's suppose the company name is ACME and the domain is acme.com the AzureOpenAI endpoint is https://llm.acme.com , however the connection fails from AnythingLLM because of the https certificate being custom . In our python code we add a directive : os.environ['REQUESTS_CA_BUNDLE'] = 'ca-bundle-full.crt' openai.api_type = 'azure' openai.api_version = "2023-03-15-preview" openai.api_base = os.getenv("BASE_URL") openai.api_key = os.getenv("OPENAIAPI_KEY") Is there any way to support this with anythingLLM?
yindo added the enhancementfeature request labels 2026-02-22 18:25:26 -05:00
yindo closed this issue 2026-02-22 18:25:26 -05:00
yindo commented 2026-02-22 18:25:26 -05:00
Author
Owner
Copy Link
Copy Source

@tech92yc commented on GitHub (Oct 2, 2024):

Adding detail : the error message is "unable to get local issuer certificate"

@tech92yc commented on GitHub (Oct 2, 2024): Adding detail : the error message is "unable to get local issuer certificate"
yindo commented 2026-02-22 18:25:26 -05:00
Author
Owner
Copy Link
Copy Source

@MrSimonC commented on GitHub (Oct 2, 2024):

@tech92yc I wanted to share my experience because my company has a similar setup. However, you haven't mentioned how you're running AnythingLLM or where the exact error you're encountering is seen. I've successfully AnythingLLM using Windows Subsystem for Linux (WSL) in a docker container, where we imported our internally signed certificate and trusted it in WSL2. When I run the Docker container for AnythingLLM, it exposes the container on a local host port, and communication works smoothly because it uses Docker and WSL with the trusted certificate.

I haven't tested the desktop version, as I suspect there would be issues with certificate trust unless it's configured at the Windows "managed computer certificates" level. The key takeaway is that if you run AnythingLLM locally in Docker and WSL2, it can work with the same setup you're using.

My notes on how we import the internal CA for WSL2:

	sudo apt-get install -y ca-certificates
	Windows: Manage Computer Certificates > Trusted Root Certificatation Authorities > Certificates > All Tasks > Export > .DER format
	.DER format to .PEM (PEM starts with the lines ----BEGIN CERTIFICATE----):
		openssl x509 -inform der -in myCACertificate.cer -out myCACertificate.crt
	sudo cp myCACertificate.crt /usr/local/share/ca-certificates
	sudo update-ca-certificates
@MrSimonC commented on GitHub (Oct 2, 2024): @tech92yc I wanted to share my experience because my company has a similar setup. However, you haven't mentioned how you're running AnythingLLM or where the exact error you're encountering is seen. I've successfully AnythingLLM using Windows Subsystem for Linux (WSL) in a docker container, where we imported our internally signed certificate and trusted it in WSL2. When I run the Docker container for AnythingLLM, it exposes the container on a local host port, and communication works smoothly because it uses Docker and WSL with the trusted certificate. I haven't tested the desktop version, as I suspect there would be issues with certificate trust unless it's configured at the Windows "managed computer certificates" level. The key takeaway is that if you run AnythingLLM locally in Docker and WSL2, it can work with the same setup you're using. My notes on how we import the internal CA for WSL2: ```bash sudo apt-get install -y ca-certificates Windows: Manage Computer Certificates > Trusted Root Certificatation Authorities > Certificates > All Tasks > Export > .DER format .DER format to .PEM (PEM starts with the lines ----BEGIN CERTIFICATE----): openssl x509 -inform der -in myCACertificate.cer -out myCACertificate.crt sudo cp myCACertificate.crt /usr/local/share/ca-certificates sudo update-ca-certificates ```
yindo commented 2026-02-22 18:25:26 -05:00
Author
Owner
Copy Link
Copy Source

@timothycarambat commented on GitHub (Oct 2, 2024):

If you can get a copy of the signed cert you can use the ENVs for https:

###########################################
######## ENABLE HTTPS SERVER ##############
###########################################
# By enabling this and providing the path/filename for the key and cert,
# the server will use HTTPS instead of HTTP.
# ENABLE_HTTPS="true"
# HTTPS_CERT_PATH="sslcert/cert.pem" # This is absolute path
# HTTPS_KEY_PATH="sslcert/key-rsa.pem" # This is absolute path

Alternatively, you can do a reverse proxy with NGINX in front of AnythingLLM and use SSL that way - example config

# Default server configuration
# Example config for regular setup + SSL + Websockets.
server {
	listen 80;
	server_name llm.website.com;
	return 301 https://llm.website.com$request_uri;
}

server {
	listen 443 ssl;
	ssl on;
	server_name llm.website.com;
	ssl_certificate /etc/letsencrypt/live/llm.website.com/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/llm.website.com/privkey.pem;	

  # Enable websocket connections for agent protocol.
	location ~* ^/api/agent-invocation/(.*) {
		proxy_pass http://localhost:3001;
		proxy_http_version 1.1;
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header Connection "Upgrade";
	}

	# Enable a custom 502 error page.
	# Must define template at /usr/share/nginx/html/502.html
	error_page 502 /502.html;
  location /502.html {
    index 502.html;
  }

	location / {
		proxy_connect_timeout       605;
    proxy_send_timeout          605;
    proxy_read_timeout          605;
    send_timeout                605;
    keepalive_timeout           605;
    proxy_buffering off;
    proxy_cache off;
    proxy_pass         http://INSTANCE_IP_ADDRESS:3001$request_uri;
  }
}
@timothycarambat commented on GitHub (Oct 2, 2024): If you can get a copy of the signed cert you can use the ENVs for https: ``` ########################################### ######## ENABLE HTTPS SERVER ############## ########################################### # By enabling this and providing the path/filename for the key and cert, # the server will use HTTPS instead of HTTP. # ENABLE_HTTPS="true" # HTTPS_CERT_PATH="sslcert/cert.pem" # This is absolute path # HTTPS_KEY_PATH="sslcert/key-rsa.pem" # This is absolute path ``` Alternatively, you can do a reverse proxy with NGINX in front of AnythingLLM and use SSL that way - example config ``` # Default server configuration # Example config for regular setup + SSL + Websockets. server { listen 80; server_name llm.website.com; return 301 https://llm.website.com$request_uri; } server { listen 443 ssl; ssl on; server_name llm.website.com; ssl_certificate /etc/letsencrypt/live/llm.website.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/llm.website.com/privkey.pem; # Enable websocket connections for agent protocol. location ~* ^/api/agent-invocation/(.*) { proxy_pass http://localhost:3001; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "Upgrade"; } # Enable a custom 502 error page. # Must define template at /usr/share/nginx/html/502.html error_page 502 /502.html; location /502.html { index 502.html; } location / { proxy_connect_timeout 605; proxy_send_timeout 605; proxy_read_timeout 605; send_timeout 605; keepalive_timeout 605; proxy_buffering off; proxy_cache off; proxy_pass http://INSTANCE_IP_ADDRESS:3001$request_uri; } } ```
yindo changed title from [FEAT]: custom HTTPS certificate for Azure OpenAI to [GH-ISSUE #2409] [FEAT]: custom HTTPS certificate for Azure OpenAI 2026-06-05 14:41:27 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label enhancement feature request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#1565
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?