mapbox static image export fails with tile server requiring client certificates

Hello,
I am using plotly.py on an internal network which does not have Internet connectivity. All connections on this network require client certificates, all servers have signed certificates for which we have a Certificate Authority bundle to verify those certificates.

I can create mapbox maps in our Jupyter environment which render appropriately, but when I try to export the map as an image using Kaleido I receive a chain of errors, concluding with error: ValueError: Transform failed with error code 525: Mapbox error. which references kaleido/scopes/plotly.py (here)

The HTTP 525 code is "SSL Handshake Failure". I'm using a 'white-bg' mapbox style and have confirmed no requests are going out looking for a mapbox server. When I remove the map tiles from the chart figure I can successfully export the map as a static image. Digging through the plotly code, it looks like the Kaleido base scope (here) is using chromium to render the map and then save it as an image.

The issue is that when I render the map in my browser, the browser has my client certificates loaded and the CA bundle loaded and it brings in the image tiles. When Plotly/Kaleido tries to retrieve the tiles using the underlying headless chromium, it's using a bare GET request and is being denied by the server (HTTP 525).

I've spent a lot of time looking for flags that could be passed to chromium to tell it to use my client certificates and the CA bundle, but (VERY surprisingly) there do not appear to be any.

A reproducible example is exactly like the Mapbox Map Layers - Base Tiles from the USGS: no token needed example, except that the server would require client certificates and could be verified with a custom CA bundle.

I would happily use a work-around if one was possible. Thanks!

Inizia riproducendo il problema dell’esportazione statica di Mapbox utilizzando l’esempio USGS base-tiles collegato in una rete che richiede certificati client. Leggi kaleido/scopes/plotly.py e kaleido/scopes/base.py, quindi determina cosa consentirebbe a Chromium headless di caricare i tiles con il certificato client e il bundle CA; il lavoro è completato quando il grafico viene esportato correttamente con questi tiles.