Https: is there a way to get the weaviate client (connect_to_XXX) to pass the https certificate

General
1

My client demands https connections. In python I use requests and pass the client.pem file through via verify=client.pem. How do I get that to happen using the weaviate clients?

I know about reverse proxy (nginx), but even with that I need to get the client.pem file to the proxy

Also, this is a self hosted app.

2

Hey,

you can initiate your client the following

with weaviate.connect_to_local(additional_config=wvc.init.AdditionalConfig(trust_env=True)) as client:

….your code…

and then set environment variables for httpx to pick up any cert files: Environment Variables - HTTPX

4

Hello

Thank you for the reply. weaviate does not use the SSL_CERT_FILE env var as far as I can tell. It does not get passed down to HTTPX.

I used python trustme to create server.pem, server.key and client.pem. Using requests.get pointing to client.pem and starting a FASTAPI server with ssl_certificate and ssl_keyfile, all works as advertised.

Starting Weaviate from a container compose file with - –scheme https - –tls-certificate server.pem - –tls_key server.key and then using a cmd line of

SSL_CERT_FILE=”./client.pem” python list_roles.py,

where:

- in load_roles.py I open a weaviate client local connection with what you indicated. I apply trust_env=True as an additional Config. This produces “weaviate.exceptions.UnexpectedStatusCodeError: Meta endpoint! Unexpected status code: 400, with response body: None.”

- I tried both connect_to_local and connect_to_custom

Even if I add cafile=”client.pem” as an additional_config argument (or an absolute path spec to the client.pem) I receive the same error

I also tried using openssl to convert the client.pem to a client.crt - same error?

5

Hey,

there are two separate pieces:

  • weaviate-client (python) - we’re using httpx under the hood, which should pick up the respective client certificates when using the environment variable I mentioned.
  • weaviate server - there is no support for anything ssl related here and you need to use your own load balancer or proxy to add ssl/client certificates support

hope that helps

6

Hello Dirk,

I understand all that! Thank you for the hints and guidance. Really appreciate your help.