fix: respect ExternalSSLInsecure config in Langfuse client TLS#132
Merged
asdek merged 2 commits intovxcontrol:feature/project_improvementsfrom Feb 23, 2026
Merged
Conversation
NewLangfuseClient receives *config.Config which provides two fields
for controlling external TLS behavior:
- ExternalSSLInsecure (EXTERNAL_SSL_INSECURE, default false)
- ExternalSSLCAPath (EXTERNAL_SSL_CA_PATH, default empty)
The previous implementation hardcoded InsecureSkipVerify: true,
ignoring both config fields. This means:
- TLS certificate verification was always disabled, even when
the user had not set EXTERNAL_SSL_INSECURE=true
- Custom CA certificates (EXTERNAL_SSL_CA_PATH) were never loaded
The fix mirrors the pattern in backend/pkg/system/utils.go:
- Set InsecureSkipVerify from cfg.ExternalSSLInsecure (default false)
- Load and apply RootCAs from cfg.ExternalSSLCAPath when set
Users who set EXTERNAL_SSL_INSECURE=true retain the previous behavior.
The default is now secure (certificate verification enabled).
Ref: vxcontrol#101
Signed-off-by: mason5052 <ehehwnwjs5052@gmail.com>
There was a problem hiding this comment.
Pull request overview
Updates the Langfuse HTTP client TLS configuration to honor external TLS settings from config.Config, aligning Langfuse connectivity with the project’s intended secure-by-default external TLS behavior.
Changes:
- Use
cfg.ExternalSSLInsecureto controltls.Config.InsecureSkipVerify(instead of hardcoding insecure TLS). - Load a custom CA bundle from
cfg.ExternalSSLCAPathand apply it to the Langfuse client TLS configuration.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
x509.NewCertPool() creates an empty pool, which discards all OS-trusted CAs when a custom EXTERNAL_SSL_CA_PATH is set. This prevents verification of any certificate not signed by the custom CA, breaking connections to Langfuse instances using public CAs. Use x509.SystemCertPool() as the starting pool (falling back to an empty pool if the system pool is unavailable) and append the custom CA to it, matching the pattern in backend/pkg/system/utils.go. Fixes review comment on PR vxcontrol#132. Signed-off-by: mason5052 <ehehwnwjs5052@gmail.com>
Contributor
|
hey @mason5052 thank you for contribution! |
33 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of the Change
Problem
NewLangfuseClientreceives*config.Configwhich provides two environment-variable-controlled fields for external TLS behavior:ExternalSSLInsecure(EXTERNAL_SSL_INSECURE, defaultfalse) - disables TLS verificationExternalSSLCAPath(EXTERNAL_SSL_CA_PATH, default empty) - path to a custom CA certificate bundleThe previous implementation hardcoded
InsecureSkipVerify: true, ignoring both config fields entirely. As a result:EXTERNAL_SSL_INSECUREwas not set (its secure default isfalse).EXTERNAL_SSL_CA_PATHwere never applied to Langfuse HTTP connections, making them ineffective for private Langfuse deployments with self-signed certificates.The same pattern was already correctly implemented in
backend/pkg/system/utils.gofor LLM provider HTTP clients.Solution
Mirror the existing pattern from
backend/pkg/system/utils.go:InsecureSkipVerifyfromcfg.ExternalSSLInsecure(secure by default:false)cfg.ExternalSSLCAPathis set, read the PEM file, parse it into anx509.CertPool, and set it asRootCAson the TLS configUsers who have
EXTERNAL_SSL_INSECURE=truein their environment retain the previous behavior.Ref: #101
Type of Change
Areas Affected
Testing and Verification
Test Steps
EXTERNAL_SSL_INSECURE=false(default): Langfuse TLS certificate is now verifiedEXTERNAL_SSL_INSECURE=true: existing behavior preserved (InsecureSkipVerify=true)EXTERNAL_SSL_CA_PATH=/path/to/ca.pem: custom CA is loaded and applied to Langfuse connectionsSecurity Considerations
EXTERNAL_SSL_INSECUREdefault offalseInsecureSkipVerify: trueshould setEXTERNAL_SSL_INSECURE=trueif their Langfuse instance uses a self-signed certificateEXTERNAL_SSL_CA_PATHfor certificate validation without disabling TLSDeployment Notes
If your self-hosted Langfuse instance uses a self-signed or private CA certificate:
EXTERNAL_SSL_CA_PATH=/path/to/ca.pemfor proper certificate validation, OREXTERNAL_SSL_INSECURE=trueto preserve the previous behaviorChecklist
Code Quality
go fmtandgo vet(for Go code)Security
Compatibility