[NguyenHoangSon96]

Closes #

Proposed Changes

• Add support for mTLS for query API.
• Add examples of how to configure mTLS.

Checklist

• CHANGELOG.md updated
• Rebased/mergeable
• A test has been added if appropriate
• Tests pass
• Commit messages are conventional
• Sign CLA (if not already signed)

[Copilot]

🟡 Changes recommended

New required constructor parameters break existing non-mTLS callers, while invalid TLS certificate configurations prevent plaintext mock servers from initializing.

5 open issues

• Keep new options optional and preserve positional argument compatibility · New
• Pass None for TLS certificates when no certificate is supplied · New
• Preserve private keys supplied through client options · New
• Clean up each HTTP server after its test iteration · New
• Skip the Polars test when the optional dependency is unavailable · New

What changed in this PR

This PR adds mutual TLS (mTLS) support to Arrow Flight queries, extending the client’s certificate settings to the query API.

Changes:

• Pass client certificates and private keys into Flight options, including bundled PEM support.
• Add TLS and mTLS query/write tests and TLS-capable mock servers.
• Add certificate fixtures and a script to regenerate them.

File	Description
tests/​util/​mocks.py	Adds TLS configuration to the Flight mock server.
tests/​test_influxdb_client_3.py	Adds TLS and mTLS success and failure cases.
tests/​data/​certificates/​other-server.pem	Bundled credentials for rejection tests.
tests/​data/​certificates/​other-server.key	Private key for untrusted test credentials.
tests/​data/​certificates/​other-server.crt	Certificate for rejection tests.
tests/​data/​certificates/​influxdb.pem	Bundled server certificate and key.
tests/​data/​certificates/​influxdb.key	Private key for TLS test servers.
tests/​data/​certificates/​influxdb.crt	Certificate for trusted TLS test servers.
tests/​data/​certificates/​client.pem	Bundled client credentials for mTLS tests.
tests/​data/​certificates/​client.key	Client private key for mTLS tests.
tests/​data/​certificates/​client.crt	Client certificate for mTLS tests.
scripts/​generate-self-signed-cert.sh	Generates self-signed certificate fixtures.
influxdb_client_3/​query/​query_api.py	Adds certificate options and forwards credentials to Flight.
influxdb_client_3/​__init__.py	Connects client certificate settings to query options.

_{Review effort: Balanced}

[codecov]

Codecov Report

❌ Patch coverage is 96.15385% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.79%. Comparing base (ea7631b) to head (4b7b65c).

Files with missing lines	Patch %	Lines
influxdb_client_3/query/query_api.py	94.44%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #254      +/-   ##
==========================================
+ Coverage   89.45%   89.79%   +0.33%     
==========================================
  Files          28       28              
  Lines        2049     2096      +47     
==========================================
+ Hits         1833     1882      +49     
+ Misses        216      214       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Copilot review overview

9 open issues

• create_write_secure_server explicitly starts the HTTP server (server.start()), but the query… · New
• This creates a tls_certificates entry even when only one of server_cert or server_cert_key is… · New
• Defaulting private_key to cert_chain can silently misconfigure mTLS when cert_chain contains… · New
• This script uses pipelines (e.g., openssl genpkey ... | openssl pkcs8 ...). With only set -e,… · New
• Private keys are being committed into the repository under tests/data/certificates. Even if these… · New
• These assertions assume the thrown exception has a .reason attribute, which is not guaranteed for… · New
• Similar to the write test, this assumes an exception .message attribute, which is not a stable… · New
• raise e resets the traceback context. Use a bare raise to preserve the original stack trace… · New
• The comment describing do_get is currently indented inside __init__, which is misleading (it… · New

5 resolved since last review

• Pass None for TLS certificates when no certificate is supplied
• Keep new options optional and preserve positional argument compatibility
• Skip the Polars test when the optional dependency is unavailable
• Clean up each HTTP server after its test iteration
• Preserve private keys supplied through client options

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

The query path ignores cert_key_password, preventing mTLS authentication with encrypted private keys, while the SSL example unconditionally loads placeholder certificate paths and fails with FileNotFoundError.

3 open issues

• Avoid running mTLS example with placeholder certificate paths · New
• Decrypt password-protected client keys before mTLS queries · New
• Private keys are being committed into the repository under tests/data/certificates. Even if these…

8 resolved since last review

• This creates a tls_certificates entry even when only one of server_cert or server_cert_key is…
• create_write_secure_server explicitly starts the HTTP server (server.start()), but the query…
• Similar to the write test, this assumes an exception .message attribute, which is not a stable…
• These assertions assume the thrown exception has a .reason attribute, which is not guaranteed for…
• This script uses pipelines (e.g., openssl genpkey ... | openssl pkcs8 ...). With only set -e,…
• Defaulting private_key to cert_chain can silently misconfigure mTLS when cert_chain contains…
• The comment describing do_get is currently indented inside __init__, which is misleading (it…
• raise e resets the traceback context. Use a bare raise to preserve the original stack trace…

_{Review effort: Balanced}