Azure / Azure/azure-cli

Allow azure-cli to trust on OS certificates

Open
#28,050 10 comments 4 reactions 1 assignee Claimed by @jiasli View on GitHub
Azure CLI Team customer-reported feature-request Third-Party
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Related command**
any command (prob REQUESTS_CA_BUNDLE is the closest)

**Is your feature request related to a problem? Please describe.**
Yes. Enabling azure-cli to work with custom trusted cert roots.

On macOS it is not simple to configure https://learn.microsoft.com/en-us/cli/azure/use-cli-effectively?tabs=bash%2Cbash2#work-behind-a-proxy as:
1. the ca_bundle is located in a folder that depends on 2 variables: client version and python version (`/usr/local/Cellar/azure-cli//libexec/lib/python/site-packages/certifi/cacert.pem`)
1. every time we upgrade the client, the bundle has to be recreated

**Describe the solution you'd like**
Allow azure-cli to trust the certificates that are trusted by the OS (keychain on macOS, others on other OS).
This could be the default behaviour or, in order to keep compat with current behaviour, allow enabling it via both env var (such as `CA_BUNDLE_TRUST_OS`) and CLI option (`--ca-bundle-trust-os`)

Alternatively (or in conjuntcion), allow specification of an additional bundle vi both env var (such as `REQUESTS_CA_BUNDLE_EXTRA`) and CLI option (`--requests-ca-bundle-extra`)

**Describe alternatives you've considered**
Implementing bash scripts that need to try to guess the correct location to place new certs, generate a new bundle, and then rewriting.

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.