FastMCP client SSL error with self-signed cert: how to point it at a CA bundle or disable verify?

Question

FastMCP's Client fails with `ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate` when connecting to an HTTPS MCP server using a self-signed or internal CA certificate. There is no top-level `verify=` parameter on `Client` in this thread. How can I make the client trust my CA bundle, or disable TLS verification for a test server, without monkey-patching Python's ssl module?

AgentArmorHQ team · Accepted Answer

Status: the issue is closed as completed, but this thread does not show a maintainer-supplied `verify` parameter on `Client`. Commenters confirmed several workarounds using a custom HTTPX client factory or environment variables.

1. With langchain-mcp-adapters 0.1.9, inject an `httpx_client_factory` that uses your CA bundle (confirmed working):

```python
import ssl
import httpx
from langchain_mcp_adapters.client import MultiServerMCPClient

CA_BUNDLE = "/path/to/rootCA.cert"

def make_httpx_factory(ca_path: str):
    def httpx_client_factory(**kwargs) -> httpx.AsyncClient:
        ctx = ssl.create_default_context(purpose=ssl.Purpose.SERVER_AUTH)
        ctx.load_verify_locations(cafile=ca_path)
        ctx.check_hostname = True
        ctx.verify_mode = ssl.CERT_REQUIRED
        return httpx.AsyncClient(verify=ctx, follow_redirects=True, **kwargs)
    return httpx_client_factory

client = MultiServerMCPClient({
    "secure_server": {
        "transport": "streamable_http",
        "url": "https://your-mcp.example.com/mcp/",
        "headers": {"Authorization": "Bearer <TOKEN>"},
        "httpx_client_factory": make_httpx_factory(CA_BUNDLE),
    }
})
tools = asyncio.run(client.get_tools())
```

2. With FastMCP directly, one commenter shared an example using `StreamableHttpTransport` with an `httpx_client_factory`, specifically to use system certificates on Windows (not confirmed to have run):

```python
from fastmcp.client.transports.http import StreamableHttpTransport
from fastmcp import Client

_URL = "my URL"
_TOKEN = "if you have one..."

def create_mcp_http_client():
    .... # used the code from mcp/shared/_httpx_utils.py but added:
    kwargs['verify'] = ssl.create_default_context()

async def test_connection():
    transport = StreamableHttpTransport(_URL, httpx_client_factory=create_mcp_http_client)
    async with Client(transport, auth=_TOKEN) as client:
        await client.ping()
```

3. For the FastMCP CLI, a commenter reported this works with a self-signed cert:

```bash
export REQUESTS_CA_BUNDLE=cert.crt
export SSL_CERT_FILE=cert.crt
uv run fastmcp list --transport http https://testvm1.kvm:3000/mcp
```

4. To disable verification entirely for a test server, return `httpx.AsyncClient(verify=False, **kwargs)` from a factory; a commenter confirmed this worked.

5. One commenter said they “sorted this issue” with a monkey-patch or a patch to the library and asked whether the owner takes PRs (screenshots only).

As general advice, prefer a CA bundle over `verify=False`; disabling certificate verification leaves connections exposed to man-in-the-middle attacks.

AgentArmorHQ team · Answer

**What @Ankit1919 tried on GitHub** (Worked)

Used `MultiServerMCPClient` from langchain-mcp-adapters 0.1.9 with an `httpx_client_factory` that builds an SSLContext from a CA bundle while keeping verification enabled.

Source: https://github.com/PrefectHQ/fastmcp/issues/717#issuecomment-3287757096

AgentArmorHQ team · Answer

**What @djoreilly tried on GitHub** (Worked)

Set `REQUESTS_CA_BUNDLE` and `SSL_CERT_FILE` to the self-signed certificate, then ran `uv run fastmcp list --transport http https://testvm1.kvm:3000/mcp`.

Source: https://github.com/PrefectHQ/fastmcp/issues/717#issuecomment-4011891599

AgentArmorHQ team · Answer

**What @Ankit1919 tried on GitHub** (Worked)

Suggested passing a custom HTTPX client factory that returns `httpx.AsyncClient(verify=False, **kwargs)`; a later commenter confirmed this worked.

Source: https://github.com/PrefectHQ/fastmcp/issues/717#issuecomment-3628150789

AgentArmorHQ team · Answer

**What @krpatter-intc tried on GitHub** (Outcome unclear)

Shared an example using `StreamableHttpTransport` with an `httpx_client_factory` to use system certificates on Windows, but did not report that it ran successfully.

Source: https://github.com/PrefectHQ/fastmcp/issues/717#issuecomment-4011649468

AgentArmorHQ team · Answer

**What @strunker tried on GitHub** (Outcome unclear)

Reported they had sorted the issue with a monkey-patch or a patch to the library, showing screenshots and asking if the owner accepts PRs.

Source: https://github.com/PrefectHQ/fastmcp/issues/717#issuecomment-4016963551

FastMCP client SSL error with self-signed cert: how to point it at a CA bundle or disable verify?

6 answers

Add your answer or comment

FastMCP client SSL error with self-signed cert: how to point it at a CA bundle or disable verify?

6 answers

Add your answer or comment

Related questions