Agents talking to MCP Server, SSL verification is failing. Has some been through this?

[aniketwattamwar]

Question

Agents talking to deployed MCP Server, SSL verification is failing. Has some been through this?

Additional Context

I have a server up and running and is able to respond with an MCP client the list of tools.
I then created an agent with crew AI following this - https://docs.crewai.com/en/mcp/streamable-http
If the MCP server is running on local it answers the questions asked to agent and works all fine.

But when I deploy it just changing the URL from localhost to deployed one gives SSL verification error as below:
httpx.ConnectError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1016)

I tried many things but always failing here. Any solution?

[maxisbey]

This is a TLS trust-store problem on the deployment, not an SDK bug — the SDK just hands the URL to httpx, and httpx is reporting that the certificate chain returned by your deployed server can't be verified against the local CA bundle.

Two things are worth checking, in order:

1. The server's TLS chain is probably incomplete. This is the #1 cause of unable to get local issuer certificate when a site loads fine in a browser but fails in Python — browsers fetch missing intermediates automatically, Python does not. Verify with:

   openssl s_client -connect your-host:443 -showcerts </dev/null
   

   or paste the hostname into https://www.ssllabs.com/ssltest/ and look at "Chain issues". If the intermediate is missing, fix it on the server / load balancer (e.g. concatenate the intermediate into your fullchain.pem, or use a properly-issued Let's Encrypt / ACME cert).

2. If the cert is from a private/internal CA, you need to point the client at a CA bundle that trusts it. The simplest way is environment variables, which httpx honors:

   export SSL_CERT_FILE=/path/to/ca-bundle.pem
   # or
   export SSL_CERT_DIR=/path/to/ca-certs/
   

You can also confirm whether the problem is the chain by hitting the endpoint with curl https://your-host/... from the same machine that runs the agent — if curl fails the same way, it's definitely the server chain.

Since you're going through CrewAI's MCPServerAdapter, any deeper httpx customization (a custom ssl.SSLContext, a custom httpx_client_factory, etc.) would need to be plumbed through CrewAI rather than this SDK, so it's worth raising that side of it on the CrewAI tracker if env vars aren't enough.

Closing as a deployment/TLS configuration question rather than an SDK issue — please reopen if it turns out the SDK is doing something wrong here.

_{AI Disclaimer}