[BUG-python/deployment] [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

[xiajing10]

Describe the bug
In Argilla version 2+, httpx.Client is created by rg.Argilla class. However, with verify=False is added, still get Error ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1000)

After investigation, verify parameter is not passed to httpx.Client through Argilla class ( from v2.2.0), both verify=False and verify='some cert path' fail.

Stacktrace and Code to create the bug

import argilla as rg
client = rg.Argilla(api_url=<argilla_service_https_url>, api_key=<api_key>, verify=False)

Tried to test with create_http_client function

from argilla._api._http._client import create_http_client
client = create_http_client(api_url=<argilla_service_https_url>, api_key=<api_key>, verify=False)
print(client._transport._pool._ssl_context.verify_mode) 

output 2

Problem is from line

transport=httpx.HTTPTransport(retries=retries)

in create_http_client

After comment this line or add verify=client_args.pop("verify", True) into httpx.HTTPTransport, output of print(client._transport._pool._ssl_context.verify_mode) turns to 0

Expected behavior
Connection to https url success with rg.Argilla(..., verify=False)

Environment:

• Argilla Version 2.2.0:
• ElasticSearch Version 8.5.3:

[xiajing10]

Tested Argilla version 2.1.0 and verify=False works fine.

[xiajing10]

@frascuchon @burtenshaw @gabrielmbmb

Hi! I found root cause was due to this commit f5ff647#diff-8f687cd6936979b7f45f8583478843e8304a317a28fd979598a0774dc91b9aa1
after adding retries in a customized transport

Similar discussion here encode/httpx#1867
httpx.HTTPTransport as a customized transport can overwrite user specified parameter.

Any suggestions to this? Thanks!

[frascuchon]

Thanks for the feedback, @xiajing10!

I've created a PR solving this #5789