Component: python/vyos/http_api_client.py

Finding (automated security review, HIGH): ApiClientConfig.verify_tls defaults to False, and ApiClient.__init__ unconditionally calls urllib3.disable_warnings(InsecureRequestWarning) when verification is off.

Why it matters: The only real consumer, src/op_mode/config_sync.py (ConfigSyncDiffManager), builds ApiClientConfig(host, key, port, timeout) without passing verify_tls, so it inherits the insecure default. config-sync connects to a remote secondary VyOS instance over HTTPS, so TLS verification is silently disabled on a remote management connection — a MITM exposure on the path that carries the API key and the full config.

Proposed direction (see PR):

• Library default verify_tls=True; allow it to also accept a CA-bundle path (forwarded to requests as verify=<path>).
• Only suppress InsecureRequestWarning when the operator has explicitly opted into insecure mode (verify_tls is False), not when a CA path or True is set.
• Thread an optional verify_tls through config_sync.py's runtime-settings loader so verification can be enabled per deployment. Default preserved as insecure to avoid regressing self-signed setups; a proper set service config-sync secondary verify-tls / ca-certificate CLI knob (XML + migration) is the follow-up.

Surfaced by automated security review on the rolling branch. The flagged code is already public in vyos/vyos-1x.