docling-serve ui fails to open https secured pdf file on a restricted network.

[jgforbes]

We have deployed docling-serve in a pod on openshift. The host container root CA bundles have been updated to the local bundle. When the ui tries to open https://arxiv.org/pdf/2501.17887 I get this error:

ERROR:docling_jobkit.orchestrators.local.worker:Worker 0 failed to process job b800c912-c67d-432b-a4a2-a8dedf6c91c8: HTTPSConnectionPool(host='arxiv.org', port=443): Max retries exceeded with url: /pdf/2501.17887 (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:998)')))

Is there an internal root CA bundle that needs to be replaced? If so why not use the host bundle?
Can SSL Verification be turned off?

[dosubot]

Hi @jgforbes! I'm Dosu and I’m helping the docling-serve team.

docling-serve does not have built-in support for configuring a custom CA bundle or disabling SSL verification via its own settings or environment variables. By default, SSL verification for outgoing HTTPS requests relies on the system or Python environment CA bundle, which can be influenced by setting the REQUESTS_CA_BUNDLE or CURL_CA_BUNDLE environment variables in your container. There is no internal CA bundle to replace, and the host bundle may not be used if the Python environment or requests library isn't pointed to it explicitly. Disabling SSL verification is not supported via configuration and would require code changes, which is not recommended for production due to security risks. For your use case, make sure the CA certificates your container uses are trusted by the Python environment, or set REQUESTS_CA_BUNDLE to your local CA bundle path if needed.
Reference

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}