Setting the AZURE_CLI_DISABLE_CONNECTION_VERIFICATION does not have any effect for SSL verification

[ScottS-byte]

Exactly as described in #9001

This is also true for Mac (Mojave).

azure-cli 2.0.77

command-modules-nspkg 2.0.3
core 2.0.77
nspkg 3.0.4
telemetry 1.0.4

Python location '/usr/local/Cellar/azure-cli/2.0.77/libexec/bin/python'
Extensions directory '/Users/scsanbeg/.azure/cliextensions'

Python (Darwin) 3.7.5 (default, Nov 1 2019, 02:16:32)
[Clang 11.0.0 (clang-1100.0.33.8)]

az storage share create --account-name $STORAGEACCT --account-key $STORAGEKEY --name "abcfs"
HTTPSConnectionPool(host='abcstorageacct.file.core.windows.net', port=443): Max retries exceeded with url: /abcfs?restype=share (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')])")))

env output: AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=any value

[haroldrandom]

@jsntcy @jiasli Please take a look

[jiasli]

Please see the doc for using CLI behind a proxy. Some data-plane SDKs including Storage SDK don't have option to disable SSL verification. Please configure REQUESTS_CA_BUNDLE and try again.

[ScottS-byte]

@jiasli I am well aware of that doc. Setting AZURE_CLI_DISABLE_CONNECTION_VERIFICATION to any value is supposed to disable the check. It does for az account list, for example, but not for az storage and a host of other commands. Therein is the problem. Actually in your document it now reads to set AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1, which I've done without change in the results.

[jiasli]

Hi @ssanbeg, I understand your concern. AZURE_CLI_DISABLE_CONNECTION_VERIFICATION doesn't work for some az storage commands because the data-plane SDK doesn't support disabling SSL verification. I have updated the doc to reflect that. Setting REQUESTS_CA_BUNDLE is the only way to fix this. Please take a try and let me know if that works. Thanks for your understanding.

[ScottS-byte]

Setting REQUESTS_CA_BUNDLE worked.