ollama - 💡(How to fix) Fix Ollama fails with TLS error [5 comments, 2 participants]

$ ollama run minimax-m2:cloud Connecting to 'minimax-m2' on 'ollama.com' ⚡

hello? Error: 500 Internal Server Error: Post "https://ollama.com:443/api/chat?ts=1773149088": tls: failed to verify certificate: SecPolicyCreateSSL error: 0

Fix Plan

The fix involves disabling certificate verification for the HTTPS connection or providing a valid certificate.

Step-by-Step Solution:

1. Disable Certificate Verification: You can disable certificate verification by setting the TLSClientConfig to InsecureSkipVerify to true. However, this is not recommended for production environments as it makes the connection vulnerable to man-in-the-middle attacks.

   import (
       "crypto/tls"
       "net/http"
   )
   
   // ...
   
   tr := &http.Transport{
       TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
   }
   client := &http.Client{Transport: tr}
   
   // Use the client to make requests

2. Provide a Valid Certificate: Ensure that the server's certificate is valid and properly configured. You can do this by:

   • Checking the server's certificate expiration date.
   • Verifying that the certificate is issued by a trusted Certificate Authority (CA).
   • Ensuring that the certificate's domain matches the server's domain.

3. Update Ollama Configuration: If you are using a self-signed certificate, you may need to update the Ollama configuration to trust the certificate. You can do this by setting the --tls-ca flag when running the Ollama command.

   ollama run --tls-ca=/path/to/ca.crt minimax-m2:cloud

Verification

To verify that the fix worked, run the Ollama command again and check for any TLS-related errors.

ollama run minimax-m2:cloud

If you no longer see the tls: failed to verify certificate error, the fix was successful.

Extra Tips

• Always use a valid certificate in production environments to ensure the security of your connections.
• If you are using a self-signed certificate, make sure to update the Ollama configuration to trust the certificate.
• Consider using a tool like curl to test the TLS connection and verify that the certificate is valid.

curl -v https://ollama.com/api/me