Azure MCP server fails sending HTTP request

Describe the bug

This broke overnight. We've been using the same Azure MCP registry for months fine.

Copilot CLI Rust runtime fails with BrokenPipe when validating Azure API Center MCP registry.

GitHub Copilot CLI 1.0.83 cannot validate MCP servers against an Azure API Center registry when enterprise MCP access is configured as Registry only.

The CLI connects successfully to the registry IP, but its native Rust runtime fails before receiving an HTTP response:

[rust:log] starting new connection 'Some("...azure-apicenter.ms")'
[rust:hyper_util::client::legacy::connect::http] connected to ...:443
[rust:hyper_util::client::legacy::client] client connection error:
hyper::Error(Shutdown, Os {
  code: 32,
  kind: BrokenPipe,
  message: "Broken pipe"
})

The same exact registry endpoints return HTTP 200 using both curl and Node.js fetch on the same machine.

A verbose curl trace shows that after the GET request is sent, the Azure endpoint initiates TLS 1.2 renegotiation and requests a client certificate:

Request completely sent off
TLSv1.2 (IN), TLS handshake, Hello request
TLSv1.2 (IN), TLS handshake, Request CERT
HTTP/1.1 200 OK

Copilot CLI logs show that registry requests use the native Rust runtime, specifically reqwest 0.13.4/hyper, rather than Node fetch. The Rust request terminates with BrokenPipe during this endpoint-specific TLS flow.

Please investigate compatibility between the Copilot CLI native runtime’s TLS backend and delayed TLS 1.2 client-certificate renegotiation.

Affected version

GitHub Copilot CLI 1.0.83

Steps to reproduce the behavior

Use GitHub Enterprise (Cloud) and GitHub Copilot Enterprise.

1. have an Azure MCP registry setup.
2. Enter the Azure URL into the MCP Registry URL
3. Select "Registry Only" for "Restrict MCP access to registry servers"
4. See a Failed to load registry: Error: HTTP request failed: error sending request for url ( <redacted> ) error message

Expected behavior

MCP registry support works

Additional context

macOS, MBP Pro ARM, iTerm2

首先使用 Copilot CLI 1.0.83 重现 Azure MCP registry 请求，然后检查延迟的 TLS 1.2 客户端证书重新协商期间原生 Rust reqwest 0.13.4/hyper 请求路径及其 TLS 后端。完成的标准是 registry 成功返回，而不是 BrokenPipe，并为这一特定 endpoint 的 TLS 流程提供覆盖。