AzureOpenAI SSL

[fcasalen]

I'm trying to use llama index with models in Azure.

I followed the steps in here

It throws a SSL Certificate error when indexing.

I tested it the AzureOpenAi class from opeanai package and it works, but I have to pass a http_client with a local certificate.

I tried to do the same with AzureOpenAI from llama_index, but it doesn't work. It stills raises the SSL certificate error.

[dosubot[bot]]

🤖

I understand you're encountering an SSL Certificate error when trying to use LlamaIndex with models in Azure. Based on the information provided and the structure of the AzureOpenAIEmbedding class in the LlamaIndex codebase, there doesn't seem to be a specific method for handling SSL certificates.

The AzureOpenAIEmbedding class primarily deals with setting up and managing connections to the Azure OpenAI service, but it does not include any methods or attributes specifically for handling SSL certificates. This could be the reason why passing a local certificate to the AzureOpenAIEmbedding class from LlamaIndex doesn't resolve the SSL certificate error.

However, without the exact error message, it's difficult to provide a precise solution. Could you please provide the exact SSL Certificate error message you're receiving? This will help in understanding the issue better and finding a suitable solution.

Also, if you could share the code snippet where you're trying to pass the local certificate to the AzureOpenAIEmbedding class, it would be helpful. This will allow me to understand your implementation and possibly identify any issues with it.

Sources

• llama_index/llms/azure_openai.py
• llama_index/embeddings/azure_openai.py

---

This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.

Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

If you want to continue the conversation, start your reply with @dosu-bot.

[fcasalen]

Code

from llama_index import VectorStoreIndex, SimpleDirectoryReader, ServiceContext
from llama_index.llms import AzureOpenAI
from llama_index.embeddings import AzureOpenAIEmbedding
from dotenv import load_dotenv
from configparser import ConfigParser, ExtendedInterpolation
from os import environ

documents = SimpleDirectoryReader('txts').load_data()
config = ConfigParser(interpolation=ExtendedInterpolation())
config.read('config.ini', 'UTF-8')
 
load_dotenv()
 
api_version = config['OPENAI']['OPENAI_API_VERSION']
api_key = config['OPENAI']['OPENAI_API_KEY']
azure_endpoint = config['OPENAI']['OPENAI_API_BASE'] + '/' +config['OPENAI']['AZURE_OPENAI_PREFIX']
chat_gpt_azure_name = config['OPENAI']['CHATGPT_MODEL']
embed_azure_name = config['OPENAI']['EMBEDDINGS_MODEL']
 
llm = AzureOpenAI(
    model="gpt-4-32k",
    engine=chat_gpt_azure_name,
    api_key=api_key,  
    azure_endpoint=azure_endpoint,
    api_version=api_version
)

embed_model = AzureOpenAIEmbedding(
    model="text-embedding-ada-002",
    deployment_name=embed_azure_name,
    api_key=api_key,  
    api_version=api_version,
    azure_endpoint=azure_endpoint
)
service_context = ServiceContext.from_defaults(llm = llm, embed_model=embed_model)

index = VectorStoreIndex.from_documents(documents, service_context=service_context)

Error message:

SSLCertVerificationError                  Traceback (most recent call last)
File [c:\Program](file:///C:/Program) Files\Python311\Lib\site-packages\httpcore\_exceptions.py:10, in map_exceptions(map)
      [9](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_exceptions.py:9) try:
---> [10](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_exceptions.py:10)     yield
     [11](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_exceptions.py:11) except Exception as exc:  # noqa: PIE786

File [c:\Program](file:///C:/Program) Files\Python311\Lib\site-packages\httpcore\_backends\sync.py:174, in SyncStream.start_tls(self, ssl_context, server_hostname, timeout)
    [173](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:173)         self.close()
--> [174](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:174)         raise exc
    [175](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:175) return SyncStream(sock)

File [c:\Program](file:///C:/Program) Files\Python311\Lib\site-packages\httpcore\_backends\sync.py:169, in SyncStream.start_tls(self, ssl_context, server_hostname, timeout)
    [168](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:168)         self._sock.settimeout(timeout)
--> [169](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:169)         sock = ssl_context.wrap_socket(
    [170](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:170)             self._sock, server_hostname=server_hostname
    [171](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:171)         )
    [172](file:///C:/Program%20Files/Python311/Lib/site-packages/httpcore/_backends/sync.py:172) except Exception as exc:  # pragma: nocover

File [c:\Program](file:///C:/Program) Files\Python311\Lib\ssl.py:517, in SSLContext.wrap_socket(self, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, session)
    [511](file:///C:/Program%20Files/Python311/Lib/ssl.py:511) def wrap_socket(self, sock, server_side=False,
    [512](file:///C:/Program%20Files/Python311/Lib/ssl.py:512)                 do_handshake_on_connect=True,
    [513](file:///C:/Program%20Files/Python311/Lib/ssl.py:513)                 suppress_ragged_eofs=True,
    [514](file:///C:/Program%20Files/Python311/Lib/ssl.py:514)                 server_hostname=None, session=None):
    [515](file:///C:/Program%20Files/Python311/Lib/ssl.py:515)     # SSLSocket class handles server_hostname encoding before it calls
    [516](file:///C:/Program%20Files/Python311/Lib/ssl.py:516)     # ctx._wrap_socket()
--> [517](file:///C:/Program%20Files/Python311/Lib/ssl.py:517)     return self.sslsocket_class._create(
    [518](file:///C:/Program%20Files/Python311/Lib/ssl.py:518)         sock=sock,
    [519](file:///C:/Program%20Files/Python311/Lib/ssl.py:519)         server_side=server_side,
    [520](file:///C:/Program%20Files/Python311/Lib/ssl.py:520)         do_handshake_on_connect=do_handshake_on_connect,
    [521](file:///C:/Program%20Files/Python311/Lib/ssl.py:521)         suppress_ragged_eofs=suppress_ragged_eofs,
    [522](file:///C:/Program%20Files/Python311/Lib/ssl.py:522)         server_hostname=server_hostname,
    [523](file:///C:/Program%20Files/Python311/Lib/ssl.py:523)         context=self,
    [524](file:///C:/Program%20Files/Python311/Lib/ssl.py:524)         session=session
    [525](file:///C:/Program%20Files/Python311/Lib/ssl.py:525)     )

File [c:\Program](file:///C:/Program) Files\Python311\Lib\ssl.py:1075, in SSLSocket._create(cls, sock, server_side, do_handshake_on_connect, suppress_ragged_eofs, server_hostname, context, session)
   [1074](file:///C:/Program%20Files/Python311/Lib/ssl.py:1074)             raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
-> [1075](file:///C:/Program%20Files/Python311/Lib/ssl.py:1075)         self.do_handshake()
   [1076](file:///C:/Program%20Files/Python311/Lib/ssl.py:1076) except (OSError, ValueError):

File [c:\Program](file:///C:/Program) Files\Python311\Lib\ssl.py:1346, in SSLSocket.do_handshake(self, block)
   [1345](file:///C:/Program%20Files/Python311/Lib/ssl.py:1345)         self.settimeout(None)
-> [1346](file:///C:/Program%20Files/Python311/Lib/ssl.py:1346)     self._sslobj.do_handshake()
   [1347](file:///C:/Program%20Files/Python311/Lib/ssl.py:1347) finally:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:992)

The above exception was the direct cause of the following exception:

and goes on...

[logan-markewich]

Maybe open a github issue for this one (or open a PR for it). Should be an easy fix

[595972434]

you can provider a customer http client to disable the verify

    llm = AzureOpenAI(
        model="gpt-4o",
        deployment_name="deployment",
        api_key=os.getenv('API_KEY'),
        azure_endpoint=os.getenv('API_ENDPOINT'),
        api_version=os.getenv('API_VERSION'),
        http_client= httpx.Client(verify=False),  # Use the sync client here
        async_http_client=httpx.AsyncClient(verify=False)  # Use the async client here
    )

[martimfasantos]

I'm also having trouble when setting the parameters for the AzureOpenAI client : #17990