Azure MCP server fails sending HTTP request

Describe the bug

This broke overnight. We've been using the same Azure MCP registry for months fine.

Copilot CLI Rust runtime fails with BrokenPipe when validating Azure API Center MCP registry.

GitHub Copilot CLI 1.0.83 cannot validate MCP servers against an Azure API Center registry when enterprise MCP access is configured as Registry only.

The CLI connects successfully to the registry IP, but its native Rust runtime fails before receiving an HTTP response:

[rust:log] starting new connection 'Some("...azure-apicenter.ms")'
[rust:hyper_util::client::legacy::connect::http] connected to ...:443
[rust:hyper_util::client::legacy::client] client connection error:
hyper::Error(Shutdown, Os {
  code: 32,
  kind: BrokenPipe,
  message: "Broken pipe"
})

The same exact registry endpoints return HTTP 200 using both curl and Node.js fetch on the same machine.

A verbose curl trace shows that after the GET request is sent, the Azure endpoint initiates TLS 1.2 renegotiation and requests a client certificate:

Request completely sent off
TLSv1.2 (IN), TLS handshake, Hello request
TLSv1.2 (IN), TLS handshake, Request CERT
HTTP/1.1 200 OK

Copilot CLI logs show that registry requests use the native Rust runtime, specifically reqwest 0.13.4/hyper, rather than Node fetch. The Rust request terminates with BrokenPipe during this endpoint-specific TLS flow.

Please investigate compatibility between the Copilot CLI native runtime’s TLS backend and delayed TLS 1.2 client-certificate renegotiation.

Affected version

GitHub Copilot CLI 1.0.83

Steps to reproduce the behavior

Use GitHub Enterprise (Cloud) and GitHub Copilot Enterprise.

1. have an Azure MCP registry setup.
2. Enter the Azure URL into the MCP Registry URL
3. Select "Registry Only" for "Restrict MCP access to registry servers"
4. See a Failed to load registry: Error: HTTP request failed: error sending request for url ( <redacted> ) error message

Expected behavior

MCP registry support works

Additional context

macOS, MBP Pro ARM, iTerm2

Commencez par reproduire la requête du registre Azure MCP avec Copilot CLI 1.0.83, puis examinez le chemin de requête natif Rust reqwest 0.13.4/hyper et son backend TLS pendant une renégociation différée du certificat client TLS 1.2. Le travail est terminé lorsque le registre renvoie une réponse avec succès au lieu de BrokenPipe, avec une couverture pour ce flux TLS spécifique à l’endpoint.