From fa4cfc9db83bfb6793ef3bd302da4654ec307403 Mon Sep 17 00:00:00 2001
From: Raykov-MS <raykovms@rshb.email.ru>
Date: Thu, 3 Sep 2026 11:43:47 +0300
Subject: [PATCH] fix

---
 api/src/core/security.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/api/src/core/security.py b/api/src/core/security.py
index 98042b9..309a402 100644
--- a/api/src/core/security.py
+++ b/api/src/core/security.py
@@ -93,7 +93,9 @@ def email_from_keycloak_payload(payload: dict | None) -> str | None:
 def _get_jwks(*, force_refresh: bool = False) -> dict:
     global _jwks_cache
     if _jwks_cache is None or force_refresh:
-        response = httpx.get(settings.JWKS_URL, timeout=10.0)
+        # Внутренний Keycloak Raisa отдаёт JWKS с корпоративным/self-signed CA;
+        # certifi в httpx эту цепочку не знает.
+        response = httpx.get(settings.JWKS_URL, timeout=10.0, verify=False)
         response.raise_for_status()
         _jwks_cache = response.json()
     return _jwks_cache