diff --git a/pdns/recursordist/rec-rust-lib/rust/src/web.rs b/pdns/recursordist/rec-rust-lib/rust/src/web.rs
index 703698cfde61..aa0a7849fa2d 100644
--- a/pdns/recursordist/rec-rust-lib/rust/src/web.rs
+++ b/pdns/recursordist/rec-rust-lib/rust/src/web.rs
@@ -198,7 +198,7 @@ fn api_wrapper(
     if !auth_ok {
         for kv in &request.vars {
             cxx::let_cxx_string!(s = &kv.value);
-            if kv.key == "x-api-key" && ctx.api_ch.as_ref().unwrap().matches(&s) {
+            if kv.key == "api-key" && ctx.api_ch.as_ref().unwrap().matches(&s) {
                 auth_ok = true;
                 break;
             }
diff --git a/pdns/recursordist/ws-recursor.cc b/pdns/recursordist/ws-recursor.cc
index d09286caa304..17a9eb5a799d 100644
--- a/pdns/recursordist/ws-recursor.cc
+++ b/pdns/recursordist/ws-recursor.cc
@@ -1066,7 +1066,7 @@ static void rustWrapper(const std::function<void(HttpRequest*, HttpResponse*)>&
     request.parameters[std::string(key)] = std::string(value);
   }
   // These two log objects are not used by the Rust code, as they take the logging object from the
-  // context, initalized from an argument to pdns::rust::web::rec::serveweb()
+  // context, initialized from an argument to pdns::rust::web::rec::serveweb()
   request.d_slog = g_slog;
   response.d_slog = g_slog;
   try {
diff --git a/regression-tests.api/runtests.py b/regression-tests.api/runtests.py
index 99932570d3eb..b82c6237529c 100755
--- a/regression-tests.api/runtests.py
+++ b/regression-tests.api/runtests.py
@@ -284,7 +284,7 @@ def finalize_server():
         if daemon == 'authoritative':
             res = requests.get('http://127.0.0.1:%s/' % WEBPORT)
         else:
-            res = requests.get('https://127.0.0.1:%s/' % WEBPORT, verify=False)
+            res = requests.get('https://127.0.0.1:%s/' % WEBPORT, verify='ca.pem')
         available = True
         break
     except HTTPError as http_err:
diff --git a/regression-tests.api/test_helper.py b/regression-tests.api/test_helper.py
index fe8272560fcb..62651b8a2f5a 100644
--- a/regression-tests.api/test_helper.py
+++ b/regression-tests.api/test_helper.py
@@ -40,7 +40,7 @@ def setUp(self):
         self.session.headers = {'X-API-Key': os.environ.get('APIKEY', 'changeme-key'), 'Origin': 'http://%s:%s' % (self.server_address, self.server_port)}
         if is_recursor():
             self.server_url = 'https://%s:%s/' % (self.server_address, self.server_port)
-            self.session.verify = False
+            self.session.verify = 'ca.pem'
 
     def url(self, relative_url):
         return urljoin(self.server_url, relative_url)
diff --git a/regression-tests.recursor-dnssec/test_Prometheus.py b/regression-tests.recursor-dnssec/test_Prometheus.py
index 065c803e6d2e..45730987551d 100644
--- a/regression-tests.recursor-dnssec/test_Prometheus.py
+++ b/regression-tests.recursor-dnssec/test_Prometheus.py
@@ -109,7 +109,7 @@ def generateRecursorConfig(cls, confdir):
     def testPrometheus(self):
         self.waitForTCPSocket("127.0.0.1", self._wsPort)
         url = 'https://user:' + self._wsPassword + '@127.0.0.1:' + str(self._wsPort) + '/metrics'
-        r = requests.get(url, timeout=self._wsTimeout, verify=False)
+        r = requests.get(url, timeout=self._wsTimeout, verify='ca.pem')
         self.assertTrue(r)
         self.assertEqual(r.status_code, 200)
         self.checkPrometheusContentBasic(r.text)