client-python icon indicating copy to clipboard operation
client-python copied to clipboard

[client] Add proxy certificate support for HTTPS connections (#12177)

Open maelv-filigran opened this issue 2 months ago • 0 comments

Proposed changes

  • Added automatic HTTPS proxy certificate handling in OpenCTI client-python
  • Implemented _setup_proxy_certificates() method that detects HTTPS_CA_CERTIFICATES environment variable and combines proxy certificates with system certificates
  • Added support for enterprise proxy environments by creating secure temporary certificate bundles
  • Configured SSL verification for both requests library and urllib through environment variables

Related issues

  • Resolves proxy connectivity issues for Python connectors in enterprise environments
  • Generalizes the connector proxy certificate fix to benefit all Python-based connectors
  • OCTI #12177

Checklist

  • [x] I consider the submitted work as finished
  • [x] I tested the code for its functionality
  • [x] I wrote test cases for the relevant uses case
  • [ ] I added/update the relevant documentation (either on github or on notion)
  • [x] Where necessary I refactored code to improve the overall quality

Further comments

This implementation provides a centralized solution for HTTPS proxy certificate handling in enterprise environments. The solution:

  • Zero Configuration: Automatically activates when HTTPS_CA_CERTIFICATES environment variable is provided
  • Enterprise Ready: Combines proxy certificates with system certificates from multiple Linux distributions (Debian/Ubuntu, RHEL/CentOS, Alpine/BSD)
  • Backwards Compatible: No impact on existing configurations
  • Secure: Uses temporary directories with proper permissions and graceful error handling
  • Universal: Benefits all Python connectors automatically without individual modifications

maelv-filigran avatar Oct 29 '25 11:10 maelv-filigran