[Workaround] SSL cert failure on api.colabfold.com + low-storage (75GB) inference path for OpenFold3

[ItsReallyDanii]

For anyone hitting urllib3.exceptions.SSLCertVerificationError on api.colabfold.com or running into disk limits on student/shared nodes (~75GB), I built a workaround operator that keeps the pipeline runnable.

What this provides

1) Scoped SSL workaround (temporary)

• Applies request/session-level SSL bypass only for the remote MSA call path.
• Security note: this is intended for constrained/demo environments, not production.

2) Low-storage validation path

• When local MSA DBs/weights are unavailable (for example, when 200GB+ assets cannot be unpacked), it switches to a pipeline validation mode.
• This allows downstream orchestration and AQAffinity wiring to be tested end-to-end.
• Scientific note: this mode is for integration validation, not final biological claims.

Repo

Code + README + config examples:
https://github.com/ItsReallyDanii/openfold3-pipeline-operator

Optional next step

If useful, I can open a PR for docs covering:

• explicit constrained-node run mode,
• security caveats for SSL bypass,
• expected behavior of validation/demo outputs.

[jnwei]

Thank you for sharing this enhancement, @ItsReallyDanii .

Could you provide a bit more context about the use case that required this set up? You mentioned low-storage / a limitation on the colabfold MSAs, perhaps you could give a general description of the sample job (e.g. number of queries or protein sequences) that caused this failure?

[ItsReallyDanii]

@jnwei

Thanks for the follow-up — happy to provide context.

My use case is a constrained student/research environment (Google Cloud L4 VM) with a hard disk limit (~75 GB). In this setting, hosting full local OpenFold/ColabFold DBs is not feasible (local DB setup fails with no-space-left errors), so remote MSA is the only practical path.

The failure I hit is reproducible on a minimal workload, so it is not tied to job size:

• Input: 1 protein sequence (~250 aa)
• Path: remote MSA via api.colabfold.com
• Outcome: failure during API handshake with SSLCertVerificationError in urllib3 before inference proceeds

So the blocker is:

1. local DB route unavailable due to storage constraints, and
2. remote route unavailable due to SSL verification failure in this environment.

The enhancement request is meant to unblock this low-resource tier by adding a guarded fallback for the remote-MSA path (not as a production default). If preferred, I can refine this into a PR with:

• default secure behavior unchanged,
• explicit opt-in flag/environment variable for fallback behavior,
• clear warning/logging when fallback is used.

I can also share exact command + traceback snippet if that helps.

[jnwei]

Thank you very much for the context @ItsReallyDanii

I am glad that you were able to find a workaround for this issue. It sounds like it was an annoying issue and the solution required engineering a balanced way to handle the SSL port. Thank you again for sharing your solution with the OpenFold3 community.

I am a bit hesitant to add the proposed SSL bypass directly in to the OpenFold3 project. While the behavior would be gated by settings configurations, I worry about the extra overhead of maintaining this code, especially with the potential security risk.

If other users also run into the same issue with the SSLCertVerificationError, I would be happy to reconsider a PR into OpenFold3. Leaving this issue open for additional discussion.

[jnwei]

Aside: If it is helpful, it is possible to run just the colabfold MSA pipeline outside of the inference loop first. One can do so with the align_msa_server entry point:

python run_openfold.py align_msa_server \
    --query_json query_example.json \
    --output_dir output/msa_server_test \
    --msa_computation_settings_yaml examples/msa_server.yml 

Where the query_json is a OpenFold3 input query json, and the example msa_server.yml may be found in the examples directory. This command would submit a query to the Colabfold server and return a new query set json that has the paths to the parsed colabfold alignments.

To run inference from there, one would then need to pass --use_msa_server=False in the command line argument and use the generated query set json with the colabfold paths as the input query set.

I think you would still run into the same SSL issue here if you ran this on the system you described. However, perhaps the colabfold alignment workflow could be performed on a different computation system that does not have the same constraints.