switch os truststore libraries (#91)

* switch os truststore libraries

* Update README.md

Co-authored-by: Copilot <[email protected]>

---------

Co-authored-by: Copilot <[email protected]>

Author: joe-clickhouse

README.md

@@ -295,6 +295,7 @@ The following environment variables are used to configure the ClickHouse and chD
 * `CLICKHOUSE_VERIFY`: Enable/disable SSL certificate verification
   * Default: `"true"`
   * Set to `"false"` to disable certificate verification (not recommended for production)
+  * TLS certificates: The package uses your operating system trust store for TLS certificate verification via `truststore`. We call `truststore.inject_into_ssl()` at startup to ensure proper certificate handling. Python’s default SSL behavior is used as a fallback only if an unexpected error occurs.
 * `CLICKHOUSE_CONNECT_TIMEOUT`: Connection timeout in seconds
   * Default: `"30"`
   * Increase this value if you experience connection timeouts

fastmcp.json

@@ -8,9 +8,8 @@
     "dependencies": [
       "clickhouse-connect",
       "python-dotenv",
-      "pip-system-certs",
+      "truststore",
       "chdb"
     ]
   }
 }
-

mcp_clickhouse/__init__.py

@@ -1,3 +1,5 @@
+import os
+
 from .mcp_server import (
     create_clickhouse_client,
     list_databases,
@@ -8,6 +10,14 @@
     chdb_initial_prompt,
 )
 
+
+if os.getenv("MCP_CLICKHOUSE_TRUSTSTORE_DISABLE", None) != "1":
+    try:
+        import truststore
+        truststore.inject_into_ssl()
+    except Exception:
+        pass
+
 __all__ = [
     "list_databases",
     "list_tables",

pyproject.toml

@@ -10,7 +10,7 @@ dependencies = [
      "fastmcp>=2.0.0",
      "python-dotenv>=1.0.1",
      "clickhouse-connect>=0.8.16",
-     "pip-system-certs>=4.0",
+     "truststore>=0.10",
      "chdb>=3.3.0",
 ]