From caa949bee0873d2b95dfb4fbeb1b7868b0ee3843 Mon Sep 17 00:00:00 2001
From: Flowseal <sellyalegium@gmail.com>
Date: Tue, 22 Sep 2026 21:26:53 +0300
Subject: [PATCH] fixes #1357 fixes #1354

---
 proxy/raw_websocket.py | 12 +++++-------
 proxy/utils.py         | 11 +++++++++--
 ui/ctk_tray_ui.py      |  5 ++---
 3 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/proxy/raw_websocket.py b/proxy/raw_websocket.py
index a718ea1..953fe86 100644
--- a/proxy/raw_websocket.py
+++ b/proxy/raw_websocket.py
@@ -1,6 +1,4 @@
 import os
-import ssl
-import certifi
 import logging
 import base64
 import struct
@@ -9,6 +7,7 @@ import socket as _socket
 
 from typing import List, Optional, Tuple
 from .config import proxy_config
+from .utils import create_ssl_context
 
 log = logging.getLogger('tg-mtproto-proxy')
 
@@ -22,9 +21,8 @@ _st_BBQ4s = struct.Struct('>BBQ4s')
 _st_H = struct.Struct('>H')
 _st_Q = struct.Struct('>Q')
 
-_ssl_ctx = ssl.create_default_context(cafile=certifi.where())
-_ssl_ctx_fronting = ssl.create_default_context(cafile=certifi.where())
-_ssl_ctx_fronting.check_hostname = False
+_ssl_ctx = create_ssl_context()
+_ssl_ctx_fronting = create_ssl_context(check_hostname=False)
 
 class WsHandshakeError(Exception):
     def __init__(self, status_code: int, status_line: str,
@@ -88,7 +86,7 @@ class RawWebSocket:
     async def connect(host: str, domain: str, timeout: float = 10.0,
                       path: str = '/apiws', *,
                       sni: Optional[str] = None, secure = True) -> 'RawWebSocket':
-        ssl = _ssl_ctx_fronting if sni else _ssl_ctx
+        ssl_context = _ssl_ctx_fronting if sni else _ssl_ctx
 
         if sni is None:
             sni = domain
@@ -97,7 +95,7 @@ class RawWebSocket:
             (
                 asyncio.open_connection(
                     host, 443,
-                    ssl=ssl,
+                    ssl=ssl_context,
                     server_hostname=sni,
                 )
                 if secure
diff --git a/proxy/utils.py b/proxy/utils.py
index 18d3a1d..a09fee2 100644
--- a/proxy/utils.py
+++ b/proxy/utils.py
@@ -140,6 +140,13 @@ class _PinnedHTTPSHandler(urllib.request.HTTPSHandler):
             return super().https_open(req)
 
 
-def build_github_opener() -> urllib.request.OpenerDirector:
+def create_ssl_context(*, check_hostname: bool = True) -> ssl.SSLContext:
     context = ssl.create_default_context(cafile=certifi.where())
-    return urllib.request.build_opener(_PinnedHTTPSHandler(context=context))
+    context.load_default_certs()
+    context.check_hostname = check_hostname
+    return context
+
+
+def build_github_opener() -> urllib.request.OpenerDirector:
+    return urllib.request.build_opener(
+        _PinnedHTTPSHandler(context=create_ssl_context()))
diff --git a/ui/ctk_tray_ui.py b/ui/ctk_tray_ui.py
index 7487e49..4adf271 100644
--- a/ui/ctk_tray_ui.py
+++ b/ui/ctk_tray_ui.py
@@ -47,11 +47,10 @@ _CFWORKER_TEST_DST = {
 def _run_connectivity_test(cases: list, *, secure: bool = True) -> dict:
     import base64
     from contextlib import nullcontext
-    import ssl
-    import certifi
     import socket as _socket
+    from proxy.utils import create_ssl_context
 
-    ctx = ssl.create_default_context(cafile=certifi.where()) if secure else None
+    ctx = create_ssl_context() if secure else None
     port = 443 if secure else 80
     results = {}
     for dc, connect_host, sni_host, req_host, path in cases: