Certificate error while calling the self hosted llm from local machine

[amalthomasintel]

I have hosted the langfuse in helm and trying to access from local application running on my machine. while using the the observe decorator its looking for certificate and error ing out:
Max retries exceeded with url: /api/public/otel/v1/traces (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain

Usually when we get this error in request call we can put verify=false. How can I suppress the error here?
Any help will be greatly appreciated

[dosubot[bot]]

This SSL certificate error is common when using self-signed certs in local or self-hosted setups. The Langfuse backend doesn’t provide a way to bypass SSL verification, so you need to handle this on the client side.

If you’re using the Langfuse Python SDK, you can either:

• Set the REQUESTS_CA_BUNDLE environment variable to point to your custom CA bundle file. This will let the SDK trust your self-signed certificate without disabling verification globally.
  Example:

  export REQUESTS_CA_BUNDLE=/path/to/your/ca-bundle.crt

  Details here

• If you want to temporarily disable SSL verification (not recommended for production), you may need to modify the SDK initialization or the underlying HTTP client to set verify=False. If you’re using httpx directly or can pass a custom client, you can do:

  import httpx
  from langfuse import Langfuse
  
  client = httpx.Client(verify=False)
  lf = Langfuse(http_client=client, ...)

  See this example

If you’re running Langfuse in Helm and want the backend to trust your self-signed CA, mount your CA cert into the container and set the NODE_EXTRA_CA_CERTS environment variable:

langfuse:
  extraVolumes:
    - configMap:
        defaultMode: 420
        name: company-ca
      name: company-ca

  extraVolumeMounts:
    - mountPath: /etc/ssl/cert.pem
      name: company-ca
      readOnly: true
      subPath: company-ca.pem

  additionalEnv:
    - name: NODE_EXTRA_CA_CERTS
      value: /etc/ssl/cert.pem

Example here

Let me know if you need a more specific code snippet for your setup.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[amalthomasintel]

Even after applying the below code its showing the same certficate error. Any way to fix it?

import httpx
from langfuse import Langfuse

client = httpx.Client(verify=False)
lf = Langfuse(http_client=client, ...)

[dosubot[bot]]

In the Langfuse Python SDK, passing verify=False to httpx.Client doesn't always suppress SSL errors. Instead, try passing a path to your CA bundle file:

client = httpx.Client(verify="/path/to/your/ca-bundle.pem")
lf = Langfuse(http_client=client, ...)

This approach is more reliably respected by the SDK than verify=False citation. Make sure your CA bundle includes the full certificate chain (root and intermediates).

You can also set the environment variable REQUESTS_CA_BUNDLE to the same CA bundle file to ensure all requests use your custom CA citation.

If you’re running Langfuse in Helm, ensure your self-signed CA is mounted and NODE_EXTRA_CA_CERTS is set in your deployment citation.

If you’re still seeing errors, check that you’re on the latest version of the SDK, as older versions may not fully respect the custom client.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}   

[Steffen911]

Here is our documentation page on how to address this: https://langfuse.com/docs/observability/sdk/python/sdk-v3#self-signed-ssl-certificates-self-hosted-langfuse.

[IvanAntipovAtExness]

@Steffen911 the link is not relevant. I try to use >3 client with both >2 and >3 server, and I get requests.exceptions.SSLError, setting
langfuse = Langfuse(
public_key=public_key,
secret_key=secret_key,
base_url=host,
httpx_client=httpx.Client(timeout=httpx.Timeout(10.0, read=300.0), verify=False)
)