fix(openai): do not pass ssl_verify to extra_body and apply per-call ssl_verify to HTTP client (#38178)

litellm/llms/openai/common_utils.py

@@ -268,6 +268,7 @@ class BaseOpenAILLM:
             "max_retries",
             "organization",
             "api_base",
+            "ssl_verify",
         )
         openai_client_fields: Final = (
             BaseOpenAILLM.get_openai_client_initialization_param_fields(client_type=client_type)
@@ -293,6 +294,7 @@ class BaseOpenAILLM:
     @staticmethod
     def _get_async_http_client(
         shared_session: Optional["ClientSession"] = None,
+        ssl_verify: Optional[Any] = None,
     ) -> httpx.AsyncClient | None:
         if litellm.aclient_session is not None:
             return litellm.aclient_session
@@ -303,7 +305,7 @@ class BaseOpenAILLM:
             return httpx.AsyncClient(transport=MockOpenAITransport())
 
         # Get unified SSL configuration
-        ssl_config: Final = get_ssl_configuration()
+        ssl_config: Final = ssl_verify if ssl_verify is not None else get_ssl_configuration()
 
         return httpx.AsyncClient(
             verify=ssl_config,
@@ -316,7 +318,9 @@ class BaseOpenAILLM:
         )
 
     @staticmethod
-    def _get_sync_http_client() -> httpx.Client | None:
+    def _get_sync_http_client(
+        ssl_verify: Optional[Any] = None,
+    ) -> httpx.Client | None:
         if litellm.client_session is not None:
             return litellm.client_session
 
@@ -326,7 +330,7 @@ class BaseOpenAILLM:
             return httpx.Client(transport=MockOpenAITransport())
 
         # Get unified SSL configuration
-        ssl_config: Final = get_ssl_configuration()
+        ssl_config: Final = ssl_verify if ssl_verify is not None else get_ssl_configuration()
 
         return httpx.Client(
             verify=ssl_config,

litellm/llms/openai/openai.py

@@ -347,6 +347,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
         organization: str | None = None,
         client: OpenAI | AsyncOpenAI | None = None,
         shared_session: Optional["ClientSession"] = None,
+        ssl_verify: Optional[Any] = None,
     ) -> OpenAI | AsyncOpenAI | None:
         client_initialization_params: Final[dict] = locals()
         if client is None:
@@ -364,9 +365,9 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                 if isinstance(cached_client, OpenAI) or isinstance(cached_client, AsyncOpenAI):
                     return cached_client
             http_client: Final[httpx.Client | httpx.AsyncClient | None] = (
-                OpenAIChatCompletion._get_async_http_client(shared_session=shared_session)
+                OpenAIChatCompletion._get_async_http_client(shared_session=shared_session, ssl_verify=ssl_verify)
                 if is_async
-                else OpenAIChatCompletion._get_sync_http_client()
+                else OpenAIChatCompletion._get_sync_http_client(ssl_verify=ssl_verify)
             )
             if is_async:
                 _new_client: OpenAI | AsyncOpenAI = AsyncOpenAI(
@@ -720,6 +721,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                     else:
                         if not isinstance(max_retries, int):
                             raise OpenAIError(status_code=422, message="max retries must be an int")
+                        ssl_verify: Final = litellm_params.get("ssl_verify", None) if litellm_params else None
                         openai_client: OpenAI = self._get_openai_client(
                             is_async=False,
                             api_key=api_key,
@@ -729,6 +731,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                             max_retries=max_retries,
                             organization=organization,
                             client=client,
+                            ssl_verify=ssl_verify,
                         )
 
                         ## LOGGING
@@ -860,6 +863,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
         )
         for _ in range(2):  # if call fails due to alternating messages, retry with reformatted message
             try:
+                ssl_verify: Final = litellm_params.get("ssl_verify", None) if litellm_params else None
                 openai_aclient: AsyncOpenAI = self._get_openai_client(
                     is_async=True,
                     api_key=api_key,
@@ -870,6 +874,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                     organization=organization,
                     client=client,
                     shared_session=shared_session,
+                    ssl_verify=ssl_verify,
                 )
 
                 ## LOGGING
@@ -1040,6 +1045,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
         data.update(self.get_stream_options(stream_options=stream_options, api_base=api_base))
         for _ in range(2):
             try:
+                ssl_verify: Final = litellm_params.get("ssl_verify", None) if litellm_params else None
                 openai_aclient: AsyncOpenAI = self._get_openai_client(
                     is_async=True,
                     api_key=api_key,
@@ -1050,6 +1056,7 @@ class OpenAIChatCompletion(BaseLLM, BaseOpenAILLM):
                     organization=organization,
                     client=client,
                     shared_session=shared_session,
+                    ssl_verify=ssl_verify,
                 )
                 ## LOGGING
                 logging_obj.pre_call(

litellm/utils.py

@@ -4558,6 +4558,8 @@ def add_provider_specific_params_to_optional_params(
             extra_body: Final = dict(passed_params.pop("extra_body", None) or {})
             for k in passed_params:
                 if k not in openai_params and passed_params[k] is not None:
+                    if k in ["ssl_verify"]:
+                        continue
                     extra_body[k] = passed_params[k]
             if not isinstance(optional_params.get("extra_body"), dict):
                 optional_params["extra_body"] = {}

tests/test_litellm/llms/openai/test_openai_ssl_verify.py

@@ -0,0 +1,71 @@
+from unittest.mock import MagicMock, patch
+import httpx
+import litellm
+from litellm.llms.openai.common_utils import BaseOpenAILLM, OpenAIChatCompletion
+from litellm.utils import get_optional_params, add_provider_specific_params_to_optional_params
+
+
+def test_ssl_verify_not_in_extra_body():
+    """
+    Ensure ssl_verify is NOT dumped into extra_body for openai and openai-compatible providers.
+    Issue #38178: ssl_verify was leaking into extra_body payload sent to OpenAI-compatible endpoints.
+    """
+    optional_params = {}
+    passed_params = {
+        "ssl_verify": "/custom/path/ca.pem",
+        "temperature": 0.7,
+        "custom_param": "value",
+    }
+    
+    result = add_provider_specific_params_to_optional_params(
+        optional_params=optional_params,
+        passed_params=passed_params,
+        custom_llm_provider="openai",
+        openai_params=["temperature"],
+    )
+    
+    extra_body = result.get("extra_body", {})
+    assert "ssl_verify" not in extra_body
+    assert extra_body.get("custom_param") == "value"
+
+
+def test_get_sync_http_client_with_ssl_verify():
+    """
+    Verify _get_sync_http_client applies per-call ssl_verify to httpx.Client(verify=...).
+    """
+    custom_ca = "/path/to/my_custom_ca.pem"
+    client = OpenAIChatCompletion._get_sync_http_client(ssl_verify=custom_ca)
+    assert client is not None
+    client_false = OpenAIChatCompletion._get_sync_http_client(ssl_verify=False)
+    assert client_false is not None
+
+
+def test_get_async_http_client_with_ssl_verify():
+    """
+    Verify _get_async_http_client applies per-call ssl_verify to httpx.AsyncClient(verify=...).
+    """
+    client_false = OpenAIChatCompletion._get_async_http_client(ssl_verify=False)
+    assert client_false is not None
+
+
+def test_cache_key_differs_by_ssl_verify():
+    """
+    Verify cache keys differ when ssl_verify differs to prevent client poisoning across CAs.
+    """
+    params_ca1 = {
+        "api_key": "sk-1234",
+        "is_async": True,
+        "ssl_verify": "/path/ca1.pem",
+    }
+    params_ca2 = {
+        "api_key": "sk-1234",
+        "is_async": True,
+        "ssl_verify": "/path/ca2.pem",
+    }
+    
+    key1 = BaseOpenAILLM.get_openai_client_cache_key(params_ca1, "openai")
+    key2 = BaseOpenAILLM.get_openai_client_cache_key(params_ca2, "openai")
+    
+    assert key1 != key2
+    assert "ssl_verify=/path/ca1.pem" in key1
+    assert "ssl_verify=/path/ca2.pem" in key2