From 112e5cc2f1e34be679d7c821fb4efc390e08bd70 Mon Sep 17 00:00:00 2001 From: bot-backend Date: Fri, 19 Jun 2026 18:19:03 +0300 Subject: [PATCH] fix(tradein): verify=False for EKB geoportal WFS (Russian-CA cert) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The geoportal serves a Russian national-CA (Минцифры) TLS cert absent from httpx's default trust store → CERTIFICATE_VERIFY_FAILED, loader fetched 0. Public read-only data → verify=False (same as the curl -k used in recon). --- .../backend/app/services/scrapers/ekb_geoportal_client.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tradein-mvp/backend/app/services/scrapers/ekb_geoportal_client.py b/tradein-mvp/backend/app/services/scrapers/ekb_geoportal_client.py index 74667b51..5557da3b 100644 --- a/tradein-mvp/backend/app/services/scrapers/ekb_geoportal_client.py +++ b/tradein-mvp/backend/app/services/scrapers/ekb_geoportal_client.py @@ -220,7 +220,12 @@ class EkbGeoportalClient: } url = f"{GEOPORTAL_HOST}{WFS_PATH}" try: - async with httpx.AsyncClient(timeout=self._timeout, headers=_BROWSER_HEADERS) as client: + # Геопортал ЕКБ отдаёт сертификат российского CA (Минцифры), которого нет в + # стандартном trust store httpx → TLS verify падает. Данные публичные, + # read-only → verify=False (тот же подход, что curl -k при разведке). + async with httpx.AsyncClient( + timeout=self._timeout, headers=_BROWSER_HEADERS, verify=False + ) as client: resp = await client.get(url, params=params) if resp.status_code != 200: logger.warning("geoportal WFS → HTTP %d for bbox=%s", resp.status_code, bbox)