Azure MCP server fails sending HTTP request

Describe the bug

This broke overnight. We've been using the same Azure MCP registry for months fine.

Copilot CLI Rust runtime fails with BrokenPipe when validating Azure API Center MCP registry.

GitHub Copilot CLI 1.0.83 cannot validate MCP servers against an Azure API Center registry when enterprise MCP access is configured as Registry only.

The CLI connects successfully to the registry IP, but its native Rust runtime fails before receiving an HTTP response:

[rust:log] starting new connection 'Some("...azure-apicenter.ms")'
[rust:hyper_util::client::legacy::connect::http] connected to ...:443
[rust:hyper_util::client::legacy::client] client connection error:
hyper::Error(Shutdown, Os {
  code: 32,
  kind: BrokenPipe,
  message: "Broken pipe"
})

The same exact registry endpoints return HTTP 200 using both curl and Node.js fetch on the same machine.

A verbose curl trace shows that after the GET request is sent, the Azure endpoint initiates TLS 1.2 renegotiation and requests a client certificate:

Request completely sent off
TLSv1.2 (IN), TLS handshake, Hello request
TLSv1.2 (IN), TLS handshake, Request CERT
HTTP/1.1 200 OK

Copilot CLI logs show that registry requests use the native Rust runtime, specifically reqwest 0.13.4/hyper, rather than Node fetch. The Rust request terminates with BrokenPipe during this endpoint-specific TLS flow.

Please investigate compatibility between the Copilot CLI native runtime’s TLS backend and delayed TLS 1.2 client-certificate renegotiation.

Affected version

GitHub Copilot CLI 1.0.83

Steps to reproduce the behavior

Use GitHub Enterprise (Cloud) and GitHub Copilot Enterprise.

1. have an Azure MCP registry setup.
2. Enter the Azure URL into the MCP Registry URL
3. Select "Registry Only" for "Restrict MCP access to registry servers"
4. See a Failed to load registry: Error: HTTP request failed: error sending request for url ( <redacted> ) error message

Expected behavior

MCP registry support works

Additional context

macOS, MBP Pro ARM, iTerm2

まず Copilot CLI 1.0.83 で Azure MCP レジストリへのリクエストを再現し、次に、遅延した TLS 1.2 クライアント証明書の再ネゴシエーション中に、ネイティブ Rust reqwest 0.13.4/hyper のリクエストパスとその TLS バックエンドを調査します。レジストリが BrokenPipe ではなく正常に応答し、このエンドポイント固有の TLS フローがカバレッジされれば完了です。