eroom.e-social.gov.az serves an incomplete certificate chain (omits the
intermediate CA that signs its leaf), so Python requests raised
CERTIFICATE_VERIFY_FAILED on the ƏMAS wizard/employee-load step. Browsers
paper over this via AIA; requests does not.
Fix without vendoring any cert into the repo: read the AIA "CA Issuers"
pointer out of the live leaf, download the missing intermediate(s) straight
from the issuer, and cache them outside the repo. Route all AMAS/MyGovID
calls through _amas_http, which self-heals across CA rotations by re-fetching
and retrying once on SSLError. SSL verification stays ON (not verify=False).
Also stop leaking raw exception strings to the UI: every AMAS-facing return
now logs the full traceback and shows the generic, localized
"ƏMAS unavailable" message. Added az/ru translations for it.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ali
6647c4a351