backend/app/worker/celery_app.py

import ssl
from celery import Celery
from app.core.config import settings

redis_url = settings.REDIS_URL

# SSL configuration for production Redis (Upstash / Redis Cloud / etc.)
# We use proper cert verification instead of the insecure CERT_NONE override.
_broker_ssl = None
_backend_ssl = None

if redis_url.startswith("rediss://"):
    # CERT_REQUIRED with the system CA bundle — correct for managed Redis providers
    _ssl_opts = {
        "ssl_cert_reqs": ssl.CERT_REQUIRED,
        "ssl_ca_certs": ssl.get_default_verify_paths().cafile,  # system CA bundle
    }
    _broker_ssl = _ssl_opts
    _backend_ssl = _ssl_opts

celery_app = Celery(
    "worker",
    broker=redis_url,
    backend=redis_url,
    include=["app.worker.tasks"],
)

celery_app.conf.update(
    task_serializer="json",
    accept_content=["json"],
    result_serializer="json",
    timezone="UTC",
    enable_utc=True,
    # Apply SSL config only when connecting to rediss:// endpoints
    broker_use_ssl=_broker_ssl,
    redis_backend_use_ssl=_backend_ssl,
)