hermes - 💡(How to fix) Fix [Bug]: custom_providers with self-signed HTTPS endpoints fail with APIConnectionError (ssl verify)

Bug Description

When using custom_providers pointing to a local HTTPS endpoint with a self-signed certificate (e.g. LiteLLM proxy), all API calls fail with APIConnectionError: Connection error after ~0.2-0.4s.

Direct curl and Python httpx requests to the same endpoint work fine. The issue is that _build_keepalive_http_client() in run_agent.py creates an httpx.HTTPTransport without verify=False, so self-signed certs are rejected silently as "Connection error".

Root Cause

In run_agent.py:2401:

return _httpx.Client(
    transport=_httpx.HTTPTransport(socket_options=_sock_opts),
    proxy=_proxy,
)

The default verify=True rejects self-signed certificates. The error surfaces as a generic APIConnectionError with no SSL-specific message, making it very hard to diagnose.

Reproduction Steps

1. Run a local LiteLLM (or any OpenAI-compatible proxy) on HTTPS with a self-signed cert
2. Configure custom_providers in config.yaml:

   custom_providers:
   - name: litellm
     base_url: https://127.0.0.1:888/v1
     api_key: sk-...
     model: some-model

3. Run hermes chat -q "hello"
4. All attempts fail with APIConnectionError: Connection error

Workaround

Patching run_agent.py to add verify=False:

return _httpx.Client(
    transport=_httpx.HTTPTransport(socket_options=_sock_opts, verify=False),
    proxy=_proxy,
    verify=False,
)

Proposed Fix

Add an ssl_verify option to custom_providers config:

custom_providers:
- name: litellm
  base_url: https://127.0.0.1:888/v1
  api_key: sk-...
  ssl_verify: false

When ssl_verify: false, pass verify=False to both the httpx.HTTPTransport and httpx.Client. This keeps the default secure (verify=True) while allowing local/self-signed endpoints.

Related Issues

• #24917 — Feature request for extra CA bundle support (same underlying TLS verification problem)
• #11969 — "APIConnectionError with custom endpoint ~80% failure rate" (likely the same root cause — intermittent SSL handshake failures with custom endpoints)

Environment

• Hermes Agent: v0.14.0
• OS: Debian (Linux 7.0.4)
• Python: 3.11.15
• Endpoint: LiteLLM proxy with self-signed cert on localhost

Affected Component

Agent (custom_providers / OpenAI client)