MSAL authentication doesn't respect REQUESTS_CA_BUNDLE for proxy certificates
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
### Describe the bug
MSAL authentication in Azure CLI doesn't respect the `REQUESTS_CA_BUNDLE` environment variable when
working behind a proxy with custom certificates. While other Azure CLI operations properly use custom CA
bundles specified via `REQUESTS_CA_BUNDLE`, the MSAL library used for authentication (particularly `az
login`) ignores this setting, causing SSL certificate verification errors even when users have correctly
configured their proxy certificates according to the official documentation.
### Related command
az login
az login --debug
### Errors
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate.
SSL: CERTIFICATE_VERIFY_FAILED
### Issue script & Debug output
# Environment setup
export HTTPS_PROXY=https://corporate-proxy:8080
export REQUESTS_CA_BUNDLE=/path/to/custom-ca-bundle.pem
# Run login with debug
az login --debug
# Debug output shows NO indication of using custom cert bundle for MSAL:
DEBUG: Getting management service client client_type=SubscriptionClient
DEBUG: urllib3.connectionpool: Starting new HTTPS connection
ERROR: SSL: CERTIFICATE_VERIFY_FAILED
# Expected debug output (missing):
DEBUG: MSAL: Using CA bundle file at '/path/to/custom-ca-bundle.pem'
# Other az commands work fine with the same REQUESTS_CA_BUNDLE:
az vm list --debug
# Shows: DEBUG: Using CA bundle file at '/path/to/custom-ca-bundle.pem'
### Expected behavior
When `REQUESTS_CA_BUNDLE` environment variable is set:
1. MSAL authentication should use the specified custom CA bundle file
2. `az login --debug` should show debug message indicating the custom CA bundle is being used
3. Authentication should succeed without SSL certificate verification errors
4. Behavior should be consistent with other Azure CLI operations that already respect this environment
variable
This is documented behavior according to:
https://learn.microsoft.com/en-us/cli/azure/use-azure-cli-successfully-troubleshooting#work-behind-a-pro
xy
### Environment Summary
azure-cli 2.77.0
core 2.77.0
telemetry 1.1.0
Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0
Python location '/opt/homebrew/Cellar/azure-cli/2.77.0/libexec/bin/python'
Config directory '/Users/ciaranfinnegan/.azure'
Extensions directory '/Users/ciaranfinnegan/.azure/cliextensions'
Python (Darwin) 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)]
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.