Azure / Azure/azure-cli

MSAL authentication doesn't respect REQUESTS_CA_BUNDLE for proxy certificates

Open
#32,207 4 comments 0 reactions 1 assignee Assigned to @jiasli View on GitHub
Account act-identity-squad act-observability-squad Auto-Assign Azure CLI Team Compute customer-reported Possible-Solution question Similar-Issue
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

MSAL authentication in Azure CLI doesn't respect the `REQUESTS_CA_BUNDLE` environment variable when
working behind a proxy with custom certificates. While other Azure CLI operations properly use custom CA
bundles specified via `REQUESTS_CA_BUNDLE`, the MSAL library used for authentication (particularly `az
login`) ignores this setting, causing SSL certificate verification errors even when users have correctly
configured their proxy certificates according to the official documentation.

### Related command

az login
az login --debug

### Errors

Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate.

SSL: CERTIFICATE_VERIFY_FAILED

### Issue script & Debug output

# Environment setup
export HTTPS_PROXY=https://corporate-proxy:8080
export REQUESTS_CA_BUNDLE=/path/to/custom-ca-bundle.pem

# Run login with debug
az login --debug

# Debug output shows NO indication of using custom cert bundle for MSAL:
DEBUG: Getting management service client client_type=SubscriptionClient
DEBUG: urllib3.connectionpool: Starting new HTTPS connection
ERROR: SSL: CERTIFICATE_VERIFY_FAILED

# Expected debug output (missing):
DEBUG: MSAL: Using CA bundle file at '/path/to/custom-ca-bundle.pem'

# Other az commands work fine with the same REQUESTS_CA_BUNDLE:
az vm list --debug
# Shows: DEBUG: Using CA bundle file at '/path/to/custom-ca-bundle.pem'

### Expected behavior

When `REQUESTS_CA_BUNDLE` environment variable is set:
1. MSAL authentication should use the specified custom CA bundle file
2. `az login --debug` should show debug message indicating the custom CA bundle is being used
3. Authentication should succeed without SSL certificate verification errors
4. Behavior should be consistent with other Azure CLI operations that already respect this environment
variable

This is documented behavior according to:
https://learn.microsoft.com/en-us/cli/azure/use-azure-cli-successfully-troubleshooting#work-behind-a-pro
xy

### Environment Summary

azure-cli 2.77.0

core 2.77.0
telemetry 1.1.0

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.77.0/libexec/bin/python'
Config directory '/Users/ciaranfinnegan/.azure'
Extensions directory '/Users/ciaranfinnegan/.azure/cliextensions'

Python (Darwin) 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)]

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.