How to disable SSL verification

[Dudssource]

What problem we are facing?

I've been trying to disable SSL verification on v88, as I suspect that this is the problem I'm facing (since we have datadog behind an internal proxy with intermediate TLS certificates).

Describe the issue

After upgrading one of our golang lambda functions extension from v68 to v88, we noticed that APM data was missing.

After inspecting logs, we noticed one of the issues with HTTP2 protocol for logs (which we solved by adding the undocumented DD_HTTP_PROTOCOL=http1 env var).

But still we can't get traces and metrics to work. (rollbacking to v68 does fix the issue)

Error logs

Unfortunately error logs don't return any useful information.

346 | 2025-11-11T10:23:09.789-03:00 | DD_EXTENSION \| ERROR \| TRACES \| Request failed: No requests sent 
347 | 2025-11-11T10:23:09.789-03:00 | DD_EXTENSION \| ERROR \| Max retries exceeded, returning request error error=Network error: client error (Connect) attempts=1

Any help would be highly appreciated.

Thanks!

[litianningdatadog]

Just to clarify, you set DD_SK​IP_SS​L_VAL​IDATI​ON=true, correct?

[Dudssource]

Just to clarify, you set DD_SK​IP_SS​L_VAL​IDATI​ON=true, correct?

That's right @litianningdatadog , we are setting this one and also the DD_LOGS_CONFIG_LOGS_NO_SSL.

[Dudssource]

After a few attempts I was able to collect more info about the error (indeed it seems like SSL check is not being disabled, even with the right env vars)

kind: InvalidData, error: InvalidCertificate(UnknownIssuer) 

[Dudssource]

I'm a bit worried about this one, after digging the extension code, I really believe that the flags DD_SKIP_SSL_VALIDATION and DD_LOGS_CONFIG_LOGS_NO_SSL were not implemented at all on the new version of the extension

[lym953]

@Dudssource #961 supports specifying custom CA certificates. It will be released in v91. Do you think this will work for you?

[Dudssource]

@lym953 using v91 traces are now working (specifying a custom CA with the DD_TLS_CERT_FILE var)! Thank you!

I'm now facing a similar problem for logs and stats

Stats:

DD_EXTENSION | ERROR | Error sending stats: Failed to send trace stats: client error (Connect)

Logs:

DD_EXTENSION | ERROR | LOGS | Failed to send request after 8 ms and 3 attempts: reqwest::Error { kind: Request, url: "https://REDACTED/api/v2/logs", source: hyper_util::client::legacy::Error(Connect, Custom { kind: Other, error: Custom { kind: InvalidData, error: InvalidCertificate(UnknownIssuer) } }) }

[lym953]

@Dudssource Thanks for the test! Seems some changes are needed on our side. Let me track this work internally.
To help us reproduce the issue: What kind of proxy are you using, e.g. NGINX or squid?

[Dudssource]

Thank you @lym953 !
We are using customized openresty proxies for logs, apm, metrics etc

[Dudssource]

@lym953 I'm not an experienced rust developer, but by looking at the code for the stats flusher, the only difference I found from trace flusher was that stats is not cloning the atomic counter for config before passing it to http_client constructor.

It would look like this:

let Ok(http_client) = ServerlessTraceFlusher::get_http_client(
            self.config.proxy_https.clone().as_ref(),
            self.config.tls_cert_file.clone().as_ref(),
        ) else {
            error!("STATS_FLUSHER | Failed to create HTTP client");
            return;
        };

I don't know if that make sense so again, I'm not a rust developer, just trying to help 😄

[lym953]

Thanks for the input! I reproduced the error on logs and metrics. Working on a fix.