Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-21 01:25:28 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #4868] [BUG]: Connection Error with Generic OpenAI and self-signed certificates #3065

New Issue
Open
opened 2026-02-22 18:32:28 -05:00 by yindo · 2 comments
yindo commented 2026-02-22 18:32:28 -05:00
Owner
Copy Link
Copy Source

Originally created by @jakehlee on GitHub (Jan 15, 2026).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4868

How are you running AnythingLLM?

AnythingLLM desktop app

What happened?

The AnythingLLM desktop application cannot connect to Generic OpenAI endpoints over HTTPS with self-signed certificates, even if the correct Root CAs are in the MacOS keychain. Instead, the application must be started from the terminal after setting NODE_EXTRA_CA_CERTS or disabling SSL with NODE_TLS_REJECT_UNAUTHORIZED=0.

This could be fixed by using office-ca or mac-ca/win-ca to pull certificates from the appropriate root stores.

Are there known steps to reproduce?

  1. Set the LLM service provider to a Generic OpenAI endpoint served over HTTPS with self-signed certificates.
  2. Send any message.
  3. "Could not respond to message: Connection Error."
  4. Re-launch the application after setting NODE_EXTRA_CA_CERTS to the root.pem or NODE_TLS_REJECT_UNAUTHORIZED=0
  5. Application behaves as expected.
Originally created by @jakehlee on GitHub (Jan 15, 2026). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4868 ### How are you running AnythingLLM? AnythingLLM desktop app ### What happened? The AnythingLLM desktop application cannot connect to Generic OpenAI endpoints over HTTPS with self-signed certificates, even if the correct Root CAs are in the MacOS keychain. Instead, the application must be started from the terminal after setting `NODE_EXTRA_CA_CERTS` or disabling SSL with `NODE_TLS_REJECT_UNAUTHORIZED=0`. This could be fixed by using `office-ca` or `mac-ca`/`win-ca` to pull certificates from the appropriate root stores. ### Are there known steps to reproduce? 1. Set the LLM service provider to a Generic OpenAI endpoint served over HTTPS with self-signed certificates. 2. Send any message. 3. "Could not respond to message: Connection Error." 4. Re-launch the application after setting `NODE_EXTRA_CA_CERTS` to the `root.pem` or `NODE_TLS_REJECT_UNAUTHORIZED=0` 5. Application behaves as expected.
yindo added the possible bug label 2026-02-22 18:32:28 -05:00
yindo changed title from [BUG]: Connection Error with Generic OpenAI and self-signed certificates to [GH-ISSUE #4868] [BUG]: Connection Error with Generic OpenAI and self-signed certificates 2026-06-05 14:50:07 -04:00
yindo commented 2026-06-05 14:50:08 -04:00
Author
Owner
Copy Link
Copy Source

@FyrbyAdditive commented on GitHub (May 21, 2026):

I also have this problem. The certificate is trusted by my device and signed by my internal CA. I can validate the certificate is trusted with openssl and it functions correctly with other applications, however this is seemingly ignored and therefore seems impossible to use securely with a local OpenAI compatible server "out the box". Tahoe 26.5. The suggested workarounds work for the time being.

<!-- gh-comment-id:4508320956 --> @FyrbyAdditive commented on GitHub (May 21, 2026): I also have this problem. The certificate is trusted by my device and signed by my internal CA. I can validate the certificate is trusted with openssl and it functions correctly with other applications, however this is seemingly ignored and therefore seems impossible to use securely with a local OpenAI compatible server "out the box". Tahoe 26.5. The suggested workarounds work for the time being.
yindo commented 2026-06-05 14:50:08 -04:00
Author
Owner
Copy Link
Copy Source

@joaocc commented on GitHub (May 26, 2026):

I have the same issue when I try to access a LM Studio via a VPN that installs the cert at the OS level.
any way to set this as a config on the app (either to trust the OS certs, or to expose NODE_TLS_REJECT_UNAUTHORIZED inside)?

<!-- gh-comment-id:4543180227 --> @joaocc commented on GitHub (May 26, 2026): I have the same issue when I try to access a LM Studio via a VPN that installs the cert at the OS level. any way to set this as a config on the app (either to trust the OS certs, or to expose NODE_TLS_REJECT_UNAUTHORIZED inside)?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label possible bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#3065
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?