Problem

When configuring a Dify endpoint using HTTPS with a self-signed certificate or a certificate signed by a private/internal CA, AIG returns a TLS connection error:

x509: certificate signed by unknown authority

Users currently work around this by manually installing CA certificates inside the running container, which is fragile and lost on container restart.

Root Cause

The LLM client (common/utils/models/openai.go) uses the openai-go SDK with its default HTTP transport, which respects the system CA bundle. The Docker images install ca-certificates but provide no mechanism to:

1. Add custom CA certificates at build time or runtime
2. Skip TLS verification (as an opt-in escape hatch)

By contrast, the AI-infra scanner (pkg/httpx/httpx.go) already uses InsecureSkipVerify: true for probe connections, but the LLM model client does not share this transport.

Affected Components

• common/utils/models/openai.go — OpenAI-compatible LLM client (used for Agent Scan, MCP Scan, Jailbreak Eval)
• Dockerfile / Dockerfile_Agent — no custom CA injection mechanism
• Potentially mcp-scan/ Python agent when calling HTTPS endpoints

Expected Behavior

Users should be able to connect to Dify (or any HTTPS AI service) without manually modifying the container, via one of:

1. Mount a custom CA bundle — documented volume mount path, e.g. /usr/local/share/ca-certificates/custom.crt + update-ca-certificates
2. Environment variable — e.g. AIG_TLS_SKIP_VERIFY=true (opt-in, clearly unsafe) or AIG_CUSTOM_CA_FILE=/path/to/ca.crt
3. UI option — toggle in Model Settings to skip TLS verification for a specific model endpoint

Suggested Fix

• Add TLS config support to the OpenAI struct (custom CA file path + optional InsecureSkipVerify)
• Pass config from model settings through to the HTTP client
• Update Dockerfile / Dockerfile_Agent with a documented CA injection pattern
• Add a note to the Dify integration docs

Steps to Reproduce

1. Deploy Dify with HTTPS using a self-signed or private CA certificate
2. Add the Dify API endpoint in AIG → Settings → Model Configuration
3. Trigger an Agent Scan or MCP Scan targeting the Dify instance
4. Observe x509: certificate signed by unknown authority error