jihoson/The-Ouroboros
1
0
Fork 0
Code Issues Pull Requests Actions 10 Packages Projects Releases Wiki Activity

SSL certificate hostname mismatch on KIS VTS (paper trading) endpoint #1

New Issue
Closed
opened 2026-02-04 03:09:36 +09:00 by jihoson · 0 comments
jihoson commented 2026-02-04 03:09:36 +09:00
Owner
Copy Link

Problem

When running in Docker, connecting to the KIS virtual trading server (openapivts.koreainvestment.com:9443) fails with:

SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed:
Hostname mismatch, certificate is not valid for 'openapivts.koreainvestment.com'.

This is a server-side issue — the KIS VTS API serves a certificate whose Subject/SAN does not match the hostname. This is a well-known issue in the Korean fintech community.

All three watchlist stocks (005930, 000660, 035420) fail on every cycle, making paper trading mode completely non-functional.

Root Cause

KISBroker._get_session() creates an aiohttp.ClientSession with default SSL verification, which correctly rejects the mismatched certificate. However, since the mismatch is on the KIS server side, we cannot fix their certificate.

Fix

Disable SSL hostname verification only for the VTS (paper trading) endpoint by creating an ssl.SSLContext with check_hostname=False and passing it via aiohttp.TCPConnector. Production endpoints remain fully verified.

Files to modify

  • src/broker/kis_api.py: Create a custom TCPConnector(ssl=ssl_ctx) when the base URL is the VTS endpoint

Verification

  • pytest -v — all 35 tests pass
  • docker compose up — no SSL errors, trading cycle proceeds
## Problem When running in Docker, connecting to the KIS virtual trading server (`openapivts.koreainvestment.com:9443`) fails with: ``` SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Hostname mismatch, certificate is not valid for 'openapivts.koreainvestment.com'. ``` This is a **server-side** issue — the KIS VTS API serves a certificate whose Subject/SAN does not match the hostname. This is a well-known issue in the Korean fintech community. All three watchlist stocks (005930, 000660, 035420) fail on every cycle, making paper trading mode completely non-functional. ## Root Cause `KISBroker._get_session()` creates an `aiohttp.ClientSession` with default SSL verification, which correctly rejects the mismatched certificate. However, since the mismatch is on the KIS server side, we cannot fix their certificate. ## Fix Disable SSL hostname verification **only** for the VTS (paper trading) endpoint by creating an `ssl.SSLContext` with `check_hostname=False` and passing it via `aiohttp.TCPConnector`. Production endpoints remain fully verified. ### Files to modify - `src/broker/kis_api.py`: Create a custom `TCPConnector(ssl=ssl_ctx)` when the base URL is the VTS endpoint ## Verification - `pytest -v` — all 35 tests pass - `docker compose up` — no SSL errors, trading cycle proceeds
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
agentson jihoson
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: jihoson/The-Ouroboros#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?