Allow for custom SSL certs to be used by the APIClient classes

[tdene]

Confirm this is an issue with the Python library and not an underlying OpenAI API

• This is an issue with the Python library

Describe the bug

Currently, the APIClient classes allow for custom timeout, custom headers, custom max_retries, to be easily passed in as parameters.

The only way to pass in custom SSL certs are by one of these two options:

• Setting the SSL_CERT_FILE environment variable. This causes issues with async calls.
• Passing in a custom http_client. This causes inconsistencies, and is unnecessarily complicated when handling both Sync and Async clients through a 3rd party library like langchain.

Instead, verify should be an argument that can be passed in just like timeout or max_retries.

PR #1205 fixes this issue.

To Reproduce

1. Try to use custom SSL certs.
2. Note the difficulty in doing so.
3. Merge in fix: make verify a client parameter (openai#1204) #1205 to make the task simple.

Code snippets

No response

OS

Ubuntu 20.04.5 LTS

Python version

Python v.3.11.6

Library version

openai v1.13.3

[rattrayalex]

Setting the SSL_CERT_FILE environment variable. This causes issues with async calls.

How so? Can you share more about this?

[rattrayalex]

FWIW I think we are more likely to simply make it easier to configure a custom client, as discussed here: #1190 (comment)

[tdene]

Setting the SSL_CERT_FILE environment variable. This causes issues with async calls.

How so? Can you share more about this?

It has to do with connecting to multiple openai-compatible servers in the same piece of user code, while the various servers have different SSL certs. Continually setting and unsetting the env-var while running async code will lead to the wrong value being read at times. Wrapping everything in an asyncio lock ends up being more difficult than using the verify parameter.

Apologies, I don't have any shareable reproduction steps.

[rattrayalex]

Got it, that makes sense - thank you.

Do you think this would work just as well for you?

import openai

client = openai.OpenAI(
  http_client=openai.DefaultHttpxClient(verify=…),
)

[tdene]

That solution would work¹. When I originally posted this I had not noticed the other discussion thread, but I've been keeping up since then.

That's part of how I'm doing it already, and a DefaultHttpxClient would make for very nice syntactic sugar. Note that an async equivalent is also needed.

Feel free to close this issue and the associated PR as completed, and I will keep an eye out for DefaultHttpxClient and update my code then.

¹ The pain with the http_client parameter comes from the langchain side (they try to use the same http_client for both sync and async), not from yours. Apologies that I was pushing the problem onto you. Once you release the DefaultHttpxClient syntactic sugar, I'll make a PR on langchain to integrate it.

[rattrayalex]

Terrific, thank you!