Conditionally apply mTLS for HTTPS connections in tellupdater to avoid certificate usage on plain HTTP requests.

src/aare/daq/tellupdater.py

@@ -45,15 +45,19 @@ def listen_to_sse():
 
             # --- MANDATORY mTLS FOR mx-db-01 ---
             import requests
-            cert_pair = (
-                "/etc/ssl/certs/secrets/mx-x10sa-queue-01.crt",
-                "/etc/ssl/certs/secrets/mx-x10sa-queue-01.key"
-            )
-            # The DigiCert root you have on the machine
-            ca_root = "/etc/ssl/certs/secrets/mx-db-01_Full_Chain_CA.pem"
+            # --- FIX: Only use certs for HTTPS (DB) connections ---
+            if sse_url.startswith("https:"):
+                cert_pair = (
+                    "/etc/ssl/certs/secrets/mx-x10sa-queue-01.crt",
+                    "/etc/ssl/certs/secrets/mx-x10sa-queue-01.key"
+                )
+                # Use the combined bundle (Intermediate + Root) if you made it
+                ca_root = "/etc/ssl/certs/secrets/mx-db-01_DigiCert_Global_Root_G2.pem"
+                response = requests.get(sse_url, stream=True, cert=cert_pair, verify=ca_root)
+            else:
+                # Robot connection (PC17488): No certs allowed on plain HTTP
+                response = requests.get(sse_url, stream=True)
 
-            # Open the stream using the certificates required by Nginx
-            response = requests.get(sse_url, stream=True, cert=cert_pair, verify=ca_root)
             response.raise_for_status()
 
             client = sseclient.SSEClient(response)