[Bug] v4.23.5 Windows + Python 3.11 下 SSL 证书验证失败导致 DeepSeek API 无法连接

[lingyun14beta]

What happened / 发生了什么

v4.23.5 更新后，Windows Server + Python 3.11 环境下，DeepSeek API
无法使用，报 SSL 证书验证失败错误。回退到 v4.23.2 问题消失。

经排查，v4.23.5 将 SSL 证书来源改为 ssl.create_default_context()
（系统证书库），但 Python 3.11 在 Windows 上不会自动加载系统证书库，
导致即使是常见的 Amazon Root CA 1 也无法验证，连接失败。

Reproduce / 如何复现？

1. Windows Server 环境部署 AstrBot v4.23.5，Python 3.11
2. 配置 DeepSeek 作为 Provider
3. 启动后 Dashboard 尝试获取模型列表
4. 出现 SSL 证书验证失败，服务不可用

验证脚本一（失败）：
import ssl, httpx, asyncio
async def test():
ctx = ssl.create_default_context()
async with httpx.AsyncClient(verify=ctx) as c:
r = await c.get("https://api.deepseek.com")
asyncio.run(test())

结果：SSL: CERTIFICATE_VERIFY_FAILED

验证脚本二（成功）：
import certifi, httpx, asyncio
async def test():
async with httpx.AsyncClient(verify=certifi.where()) as c:
r = await c.get("https://api.deepseek.com/models",
headers={"Authorization": "Bearer YOUR_KEY"})
print(r.status_code, r.text)
asyncio.run(test())

结果：200 + 模型列表正常返回

AstrBot version, deployment method (e.g., Windows Docker Desktop deployment), provider used, and messaging platform used. / AstrBot 版本、部署方式（如 Windows Docker Desktop 部署）、使用的提供商、使用的消息平台适配器

AstrBot 版本：v4.23.5
Python 版本：3.11
使用的 Provider：DeepSeek

OS

Windows

Logs / 报错日志

[2026-04-24 23:07:06.635] [Core] [ERRO] [v4.23.5] [routes.config:1006]: Traceback (most recent call last):
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_transports\default.py", line 101, in map_httpcore_exceptions
yield
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_transports\default.py", line 394, in handle_async_request
resp = await self._pool.handle_async_request(req)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_async\connection_pool.py", line 256, in handle_async_request
raise exc from None
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_async\connection_pool.py", line 236, in handle_async_request
response = await connection.handle_async_request(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_async\connection.py", line 101, in handle_async_request
raise exc
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_async\connection.py", line 78, in handle_async_request
stream = await self._connect(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_async\connection.py", line 156, in _connect
stream = await stream.start_tls(**kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_backends\anyio.py", line 67, in start_tls
with map_exceptions(exc_map):
File "C:\Program Files\Python311\Lib\contextlib.py", line 155, in exit
self.gen.throw(typ, value, traceback)
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpcore_exceptions.py", line 14, in map_exceptions
raise to_exc(exc) from exc
httpcore.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\openai_base_client.py", line 1601, in request
response = await self._client.send(
^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_client.py", line 1629, in send
response = await self._send_handling_auth(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_client.py", line 1657, in _send_handling_auth
response = await self._send_handling_redirects(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_client.py", line 1694, in _send_handling_redirects
response = await self._send_single_request(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_client.py", line 1730, in _send_single_request
response = await transport.handle_async_request(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_transports\default.py", line 393, in handle_async_request
with map_httpcore_exceptions():
File "C:\Program Files\Python311\Lib\contextlib.py", line 155, in exit
self.gen.throw(typ, value, traceback)
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\httpx_transports\default.py", line 118, in map_httpcore_exceptions
raise mapped_exc(message) from exc
httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\astrbot\dashboard\routes\config.py", line 982, in get_provider_source_models
models = await inst.get_models()
^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\astrbot\core\provider\sources\openai_source.py", line 514, in get_models
models = await self.client.models.list()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\openai_base_client.py", line 307, in _get_page
return await self._client.request(self._page_cls, self._options)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\Administrator\Desktop\chatbot\AstrBotLauncher-0.2.0\AstrBot\venv\Lib\site-packages\openai_base_client.py", line 1633, in request
raise APIConnectionError(request=request) from err
openai.APIConnectionError: Connection error.

Are you willing to submit a PR? / 你愿意提交 PR 吗？

• Yes!

Code of Conduct

• I have read and agree to abide by the project's Code of Conduct。

[dosubot]

感谢详细的 Bug 报告和复现步骤！

根本原因确认： v4.23.5 在 network_utils.py 中将 SSL 验证改为使用 ssl.create_default_context()（即 _SYSTEM_SSL_CTX），用于所有 httpx 客户端 [1]。这个更改的初衷是解决某些国内/自定义模型服务商的 CA 链不在 certifi 中的问题 [2]，但在 Windows + Python 3.11 环境下，ssl.create_default_context() 不会自动加载系统证书库，导致了你报告的问题。

项目中已有现成的解决方案： astrbot/utils/http_ssl_common.py 中已经实现了 build_ssl_context_with_certifi() 函数 [3]，它的做法正是先 ssl.create_default_context()，然后再叠加 certifi.where() 作为补充——这是一个混合策略，既保留系统证书库的兼容性，又用 certifi 兜底。

建议修复方向： 将 network_utils.py 第 9 行的：

_SYSTEM_SSL_CTX = ssl.create_default_context()

替换为调用已有的混合方法：

from astrbot.utils.http_ssl_common import build_ssl_context_with_certifi
_SYSTEM_SSL_CTX = build_ssl_context_with_certifi()

这样既能解决 Windows + Python 3.11 的证书缺失问题，又能保留对系统证书库中自定义 CA 的支持。

期待你的 PR！

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[lingyun14beta]

好像哪里不对，是服务器问题还是astr问题（思考ing）