AZ Login fails with SSL intercept for 2.77.0
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
## Describe the bug
When in an environment using SSL decryption for outbound traffic, v2.77.0 does not acknowledge the SSL configuration passed in from the cacert.pem file and environment variable being set that all other versions do. There is no updated documentation for a different configuration required for this version. 2.76.0 worked just fine.
**Command Name**
`az login`
**Errors:**
```
PS Z:\> az login
az : ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by
SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
At line:1 char:1
+ az login
+ ~~~~~~~~
+ CategoryInfo : NotSpecified: (ERROR: HTTPSCon...ssl.c:1032)'))):String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the
trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.
```
## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.
- _Put any pre-requisite steps here..._
- Configure cacert.pem with intercept cert, set CA_REQUESTS_BUNDLE environment variable. Worked in all prior installed versions including 2.76.0
- `az login`
## Expected Behavior
Acknowledge the certificate in the ca bundle and continue login operations
## Environment Summary
```
Windows-11-10.0.22631-SP0
Python 3.12.10
Installer: MSI
azure-cli 2.77.0 *
```
## Additional Context
Have attempted 32 and 64 bit on 2.77.0 with same behavior. 2.76.0 works fine, and even down to 2.35.0 worked fine with the documented configuration for an SSL intercept.
Contributor guide
Assessment
This issue has not been assessed yet.