Code node execution error

[kingWYZ]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

Content

The code node execution failed with an error <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1017)>

Here’s the content of my code node:

import pandas as pd
import json
from datetime import datetime

def main(file_url: str, sheet: str, type: int, row: int, column: int):
try:
df = pd.read_excel(
file_url,
sheet_name=sheet,
header=None,
)

    if type == "1":
        value = df.iat[column, row]
        return {
            "result": str(value)
        }
    else:
        json_array = df.to_json(orient='records', force_ascii=False)
        return {
            "result": json.dumps(json_array,ensure_ascii=False,default=datetime_converter)
        }
except Exception as e:
    return {
        "result": str(e)
    }

def datetime_converter(o):
if isinstance(o, datetime):
return o.isoformat()

[dosubot[bot]]

This SSL error occurs because the code execution environment can't verify the SSL certificate of the server hosting your Excel file. There are a couple of ways to resolve it:

Option 1: Disable SSL verification for code execution

Set this environment variable in your Dify API service configuration:

CODE_EXECUTION_SSL_VERIFY=false

This controls whether the code execution service validates SSL certificates when making HTTPS requests [1]. Note that this is less secure and best suited for development or trusted network environments.

Option 2: Add your CA certificate at the container level

If you're running Dify via Docker, you can mount your organization's CA certificate into the container and update the system's trusted certificate store. This maintains SSL verification while resolving the "unable to get local issuer certificate" error.

---

Additionally, if you're running a recent version of Dify and using SSRF proxy protection with separate HTTP/HTTPS proxy endpoints, make sure you have the fix from PR #36455 [2] which ensures SSL verification settings propagate correctly to proxy transports.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.

[kingWYZ]

My version is 1.13.0. At first, this error didn't appear, but after a while it started happening, and changing CODE_EXECUTION_SSL_VERIFY still didn't fix it.

[dosubot[bot]]

That makes sense — CODE_EXECUTION_SSL_VERIFY only controls SSL verification between the Dify API and the sandbox service itself, not the outbound HTTPS requests your code makes from within the sandbox (e.g., pd.read_excel(file_url)) [1].

Your code's outbound HTTPS requests are routed through Dify's SSRF proxy, and there's a known bug where the SSL verification setting isn't properly passed to the proxy's transport layers [2]. This explains why it worked initially and then started failing intermittently.

Workarounds:

1. Set HTTP_REQUEST_NODE_SSL_VERIFY=false in your .env file — though due to the bug, this alone may not be sufficient on v1.13.0.

2. Patch api/core/helper/ssrf_proxy.py to pass the verify parameter to the proxy transports [2]:

   "https://": httpx.HTTPTransport(
       proxy=dify_config.SSRF_PROXY_HTTPS_URL,
       verify=verify,
   ),

   Then rebuild your Docker image.

3. Alternative in your code: You could try adding SSL context handling directly in your code node by using urllib3 or setting ssl options, though sandbox restrictions may limit this.

A fix for this was merged in PR #36455 which ensures SSL verification settings properly propagate to per-scheme proxy transports. Upgrading to a version that includes this fix should resolve the issue.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.