Connectivity SSL Error When accessing ACR through a proxy

[sata-sa]

Describe the bug

Environment : Windows ( 64 bit )
My CX is trying to connect to an ACR from a VM with a proxy.

We have tried to add the documentation mention in the url below
https://learn.microsoft.com/en-us/cli/azure/use-azure-cli-successfully-troubleshooting?view=azure-cli-latest#work-behind-a-proxy

PS C:\Users\RRamachandran> Get-Variable -Name "REQUESTS_CA_BUNDLE"
Name Value

---

REQUESTS_CA_BUNDLE C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem

When connecting it is still failing.

PS C:\Users> az acr login --name acragenticainova
Could not connect to the registry login server 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Please verify that the registry exists and the URL 'https://acragenticainova-dad4auhga8feekaq.azurecr.io/v2/' is reachable from your environment.
Try running 'az acr check-health -n acragenticainova --yes' to diagnose this issue.
PS C:\Users\RRamachandran> az acr check-health -n acragenticainova --yes
Docker daemon status: available
Docker version: 'Docker version 28.1.1, build 01f442b, platform linux/amd64'
Docker pull of 'mcr.microsoft.com/mcr/hello-world:latest' : OK
Azure CLI version: 2.74.0
DNS lookup to acragenticainova-dad4auhga8feekaq.azurecr.io at IP 20.52.88.76 : OK
2025-08-07 09:37:47.266866 An error occurred: CONNECTIVITY_SSL_ERROR
Unable to establish a secure connection to the registry 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Are you using a proxy server?

Please refer to https://aka.ms/acr/errors#connectivity_ssl_error for more information.

Related command

az acr login --name acragenticainova
az acr check-health -n acragenticainova --yes

Errors

PS C:\Users> az acr login --name acragenticainova
Could not connect to the registry login server 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Please verify that the registry exists and the URL 'https://acragenticainova-dad4auhga8feekaq.azurecr.io/v2/' is reachable from your environment.
Try running 'az acr check-health -n acragenticainova --yes' to diagnose this issue.
PS C:\Users> az acr check-health -n acragenticainova --yes
Docker daemon status: available
Docker version: 'Docker version 28.1.1, build 01f442b, platform linux/amd64'
Docker pull of 'mcr.microsoft.com/mcr/hello-world:latest' : OK
Azure CLI version: 2.74.0
DNS lookup to acragenticainova-dad4auhga8feekaq.azurecr.io at IP 20.52.88.76 : OK
2025-08-07 09:37:47.266866 An error occurred: CONNECTIVITY_SSL_ERROR
Unable to establish a secure connection to the registry 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Are you using a proxy server?

Please refer to https://aka.ms/acr/errors#connectivity_ssl_error for more information.

Issue script & Debug output

PS C:\Users\RRamachandran> az acr check-health -n acragenticainova --yes --debug
cli.knack.cli: Command arguments: ['acr', 'check-health', '-n', 'acragenticainova', '--yes', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
Enable VT mode.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x0000022CB819B2E0>, <function OutputProducer.on_global_arguments at 0x0000022CB853C180>, <function CLIQuery.on_global_arguments at 0x0000022CB8561580>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'acr': ['azure.cli.command_modules.acr']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: acr 0.836 36 149
cli.azure.cli.core: Total (1) 0.836 36 149
cli.azure.cli.core: Loaded 36 groups, 149 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : acr check-health
cli.azure.cli.core: Command table: acr check-health
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x0000022CBA81B1A0>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\RRamachandran.azure\commands\2025-08-07.09-27-36.acr_check-health.7788.log'.
az_command_data_logger: command args: acr check-health -n {} --yes --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x0000022CBA843A60>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x0000022CBA8E22A0>, <function register_cache_arguments..add_cache_arguments at 0x0000022CBA8E23E0>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x0000022CBA8E2480>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x0000022CB853C220>, <function CLIQuery.handle_query_parameter at 0x0000022CB8561620>, <function register_ids_argument..parse_ids_arguments at 0x0000022CBA8E2340>]
cli.azure.cli.command_modules.acr.check_health: Docker daemon status: available
cli.azure.cli.command_modules.acr.check_health: Docker version: 'Docker version 28.1.1, build 01f442b, platform linux/amd64'
cli.azure.cli.command_modules.acr.check_health: Docker pull of 'mcr.microsoft.com/mcr/hello-world:latest' : OK
cli.azure.cli.command_modules.acr.check_health: Azure CLI version: 2.74.0
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\Users\RRamachandran\.azure\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\RRamachandran.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf
msal.authority: openid_config("https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: f4a366c8-d0b7-4d2d-8925-3b94018f7f3d
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/7b08e924-8e20-4296-a4c6-aec590fcae95/resources?$filter=resourceType%20eq%20%27Microsoft.ContainerRegistry%2Fregistries%27&api-version=2024-11-01'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'c09c3339-7370-11f0-8965-002248d4626a'
cli.azure.cli.core.sdk.policies: 'CommandName': 'acr check-health'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '-n --yes --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.74.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/7b08e924-8e20-4296-a4c6-aec590fcae95/resources?$filter=resourceType%20eq%20%27Microsoft.ContainerRegistry%2Fregistries%27&api-version=2024-11-01 HTTP/1.1" 200 842
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '842'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '254fd190-8c8d-4909-8f42-661a450e9216'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '254fd190-8c8d-4909-8f42-661a450e9216'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'GERMANYNORTH:20250807T092745Z:254fd190-8c8d-4909-8f42-661a450e9216'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: FF22631DA6DB4BA6ACC959990AFE0A9C Ref B: FRA231050411031 Ref C: 2025-08-07T09:27:45Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 07 Aug 2025 09:27:44 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"value":[{"id":"/subscriptions/7b08e924-8e20-4296-a4c6-aec590fcae95/resourceGroups/rg-nova-sandbox-gwc-1/providers/Microsoft.ContainerRegistry/registries/acragenticainova","name":"acragenticainova","type":"Microsoft.ContainerRegistry/registries","sku":{"name":"Standard","tier":"Standard"},"location":"germanywestcentral","tags":{"Application name":"Nova","Ardoq_ID":"TBD","Automation":"TBD","Change ID":"TBD","Costcenter":"TBD","Date of creation":"TBD","Environment":"Sandbox","IT or OT":"TBD","PPO_ID":"TBD","Primary country":"TBD","SAP_SID":"TBD","Severity":"TBD","Tech. Vendor":"TBD"},"systemData":{"createdBy":"Rahul.Ramachandran@externi.cz","createdByType":"User","createdAt":"2025-07-25T08:56:29.7074068Z","lastModifiedBy":"Rahul.Ramachandran@externi.cz","lastModifiedByType":"User","lastModifiedAt":"2025-07-31T11:25:14.9195528Z"}}]}
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ContainerRegistryManagementClient
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: Initializing with Entra authority: https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf
msal.authority: openid_config("https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/v2.0/.well-known/openid-configuration") = {'token_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/7ef011f8-898a-4d01-8232-9087b2c2abaf/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? True
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: a227d381-c18f-4a27-86b2-dd8a50bb5ed2
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/7b08e924-8e20-4296-a4c6-aec590fcae95/resourceGroups/rg-nova-sandbox-gwc-1/providers/Microsoft.ContainerRegistry/registries/acragenticainova?api-version=2025-03-01-preview'
cli.azure.cli.core.sdk.policies: Request method: 'GET'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'c09c3339-7370-11f0-8965-002248d4626a'
cli.azure.cli.core.sdk.policies: 'CommandName': 'acr check-health'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '-n --yes --debug'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.74.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.10 (Windows-11-10.0.26100-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': ''
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: This request has no body
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/7b08e924-8e20-4296-a4c6-aec590fcae95/resourceGroups/rg-nova-sandbox-gwc-1/providers/Microsoft.ContainerRegistry/registries/acragenticainova?api-version=2025-03-01-preview HTTP/1.1" 200 1813
cli.azure.cli.core.sdk.policies: Response status: 200
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '1813'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'api-supported-versions': '2025-03-01-preview'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'eba2ad98-21c3-4fa2-8db8-62c469fd84e2'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'eba2ad98-21c3-4fa2-8db8-62c469fd84e2'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'GERMANYNORTH:20250807T092745Z:eba2ad98-21c3-4fa2-8db8-62c469fd84e2'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: D3DDDD89C8C84F428EBAA02BFD3D7999 Ref B: FRA231050414037 Ref C: 2025-08-07T09:27:45Z'
cli.azure.cli.core.sdk.policies: 'Date': 'Thu, 07 Aug 2025 09:27:44 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"sku":{"name":"Standard","tier":"Standard"},"type":"Microsoft.ContainerRegistry/registries","id":"/subscriptions/7b08e924-8e20-4296-a4c6-aec590fcae95/resourceGroups/rg-nova-sandbox-gwc-1/providers/Microsoft.ContainerRegistry/registries/acragenticainova","name":"acragenticainova","location":"germanywestcentral","tags":{"Application name":"Nova","Ardoq_ID":"TBD","Automation":"TBD","Change ID":"TBD","Costcenter":"TBD","Date of creation":"TBD","Environment":"Sandbox","IT or OT":"TBD","PPO_ID":"TBD","Primary country":"TBD","SAP_SID":"TBD","Severity":"TBD","Tech. Vendor":"TBD"},"systemData":{"createdBy":"Rahul.Ramachandran@externi.cz","createdByType":"User","createdAt":"2025-07-25T08:56:29.7074068+00:00","lastModifiedBy":"Rahul.Ramachandran@externi.cz","lastModifiedByType":"User","lastModifiedAt":"2025-07-31T11:25:14.9195528+00:00"},"properties":{"loginServer":"acragenticainova-dad4auhga8feekaq.azurecr.io","creationDate":"2025-07-25T08:56:29.7074068Z","provisioningState":"Succeeded","adminUserEnabled":true,"policies":{"quarantinePolicy":{"status":"disabled"},"trustPolicy":{"type":"Notary","status":"disabled"},"retentionPolicy":{"days":7,"lastUpdatedTime":"2025-07-25T08:56:34.2137426+00:00","status":"disabled"},"exportPolicy":{"status":"enabled"},"azureADAuthenticationAsArmPolicy":{"status":"enabled"},"softDeletePolicy":{"retentionDays":7,"lastUpdatedTime":"2025-07-31T11:25:14.9531722+00:00","status":"disabled"}},"encryption":{"status":"disabled"},"dataEndpointEnabled":false,"dataEndpointHostNames":[],"privateEndpointConnections":[],"publicNetworkAccess":"Enabled","networkRuleBypassOptions":"AzureServices","zoneRedundancy":"Disabled","anonymousPullEnabled":false,"metadataSearch":"Disabled","roleAssignmentMode":"LegacyRegistryPermissions","autoGeneratedDomainNameLabelScope":"TenantReuse"}}
cli.azure.cli.command_modules.acr.check_health: DNS lookup to acragenticainova-dad4auhga8feekaq.azurecr.io at IP 20.52.88.76 : OK
cli.azure.cli.command_modules.acr.check_health: 2025-08-07 09:27:45.595133 Sending a HTTP GET request to https://acragenticainova-dad4auhga8feekaq.azurecr.io/v2/
urllib3.connectionpool: Starting new HTTPS connection (1): acragenticainova-dad4auhga8feekaq.azurecr.io:443
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 712, in urlopen
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 1014, in prepare_proxy
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connection.py", line 419, in connect
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/ssl.py", line 449, in ssl_wrap_socket
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
File "ssl.py", line 455, in wrap_socket
File "ssl.py", line 1041, in _create
File "ssl.py", line 1319, in do_handshake
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/adapters.py", line 667, in send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 801, in urlopen
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/retry.py", line 594, in increment
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='acragenticainova-dad4auhga8feekaq.azurecr.io', port=443): Max retries exceeded with url: /v2/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acr/check_health.py", line 237, in _get_registry_status
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/api.py", line 73, in get
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/api.py", line 59, in request
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/sessions.py", line 589, in request
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/sessions.py", line 703, in send
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/adapters.py", line 698, in send
requests.exceptions.SSLError: HTTPSConnectionPool(host='acragenticainova-dad4auhga8feekaq.azurecr.io', port=443): Max retries exceeded with url: /v2/ (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1010)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 666, in execute
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 734, in _run_jobs_serially
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 703, in _run_job
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 336, in call
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 120, in handler
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acr/check_health.py", line 464, in acr_check_health
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acr/check_health.py", line 345, in _check_registry_health
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acr/check_health.py", line 240, in _get_registry_status
File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/acr/check_health.py", line 41, in _handle_error
knack.util.CLIError: 2025-08-07 09:27:45.658646 An error occurred: CONNECTIVITY_SSL_ERROR
Unable to establish a secure connection to the registry 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Are you using a proxy server?

Please refer to https://aka.ms/acr/errors#connectivity_ssl_error for more information.

cli.azure.cli.core.azclierror: 2025-08-07 09:27:45.658646 An error occurred: CONNECTIVITY_SSL_ERROR
Unable to establish a secure connection to the registry 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Are you using a proxy server?

Please refer to https://aka.ms/acr/errors#connectivity_ssl_error for more information.
az_command_data_logger: 2025-08-07 09:27:45.658646 An error occurred: CONNECTIVITY_SSL_ERROR
Unable to establish a secure connection to the registry 'acragenticainova-dad4auhga8feekaq.azurecr.io'. Are you using a proxy server?

Please refer to https://aka.ms/acr/errors#connectivity_ssl_error for more information.
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x0000022CBA81B420>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 10.866 seconds (init: 0.504, invoke: 10.362)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 4197 in cache file under C:\Users\RRamachandran.azure\telemetry\20250807092745778
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry_init_.pyc C:\Users\RRamachandran.azure C:\Users\RRamachandran.azure\telemetry\20250807092745778"
telemetry.process: Return from creating process 20548
telemetry.main: Finish creating telemetry upload process.

Expected behavior

Be able to login and connect to ACR.

Environment Summary

#az --version
azure-cli 2.74.0

core 2.74.0
telemetry 1.1.0

Dependencies:
msal 1.32.3
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\RRamachandran.azure'
Extensions directory 'C:\Users\RRamachandran.azure\cliextensions'

Python (Windows) 3.12.10 (tags/v3.12.10:0cc8128, Apr 8 2025, 12:21:36) [MSC v.1943 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

No response

[azure-client-tools-bot-prd]

Hi @sata-sa,

2.74.0 is not the latest Azure CLI(2.76.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• Azure CLI on Windows - az login certificate verify failed - in Powershell or CommandLine #8632

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Setting environment variables like REQUESTS_CA_BUNDLE or AZURE_CLI_DISABLE_CONNECTION_VERIFICATION are definitely supported in PowerShell. I suggest you try out.

Reference:

• Azure CLI on Windows - az login certificate verify failed - in Powershell or CommandLine #8632 (comment)

Solution 2:

See this workaround from #8734 (comment).

Reference:

• Azure CLI on Windows - az login certificate verify failed - in Powershell or CommandLine #8632 (comment)

Powered by issue-sentinel

[sata-sa]

CX upgraded to version 2.76.0 and tried to use also "AZURE_CLI_DISABLE_CONNECTION_VERIFICATION" to true using Set-Variable -Name "AZURE_CLI_DISABLE_CONNECTION_VERIFICATION" -Value "1" without success.

[rabpoi]

Hello team,
do we have any updates on this?
thank you

[shizhMSFT]

Based on the provided log, it looks like your local proxy is not well set. Could you double check your proxy and proxy settings?

You may also want to test directly using curl:

# on Linux, macOS, or WSL
curl -v "https://acragenticainova-dad4auhga8feekaq.azurecr.io/v2/"

# on Windows
curl.exe -v "https://acragenticainova-dad4auhga8feekaq.azurecr.io/v2/"

[rabpoi]

Hello @shizhMSFT

Could you please guide on what exactly is to be checked for the proxy settings ?

In addition, please find below the result of the curl request from the windows virtual machine.

C:\Users> curl.exe -v "https://acragenticainova-dad4auhga8feekaq.azurecr.io/v2/"

• Host acragenticainova-dad4auhga8feekaq.azurecr.io:443 was resolved.
• IPv6: (none)
• IPv4: 20.52.88.76
• Trying 20.52.88.76:443...
• schannel: disabled automatic use of client certificate
• ALPN: curl offers http/1.1
• ALPN: server accepted http/1.1
• Connected to acragenticainova-dad4auhga8feekaq.azurecr.io (20.52.88.76) port 443
• using HTTP/1.x

GET /v2/ HTTP/1.1
Host: acragenticainova-dad4auhga8feekaq.azurecr.io
User-Agent: curl/8.13.0
Accept: /

• schannel: remote party requests renegotiation
• schannel: renegotiating SSL/TLS connection
• schannel: SSL/TLS connection renegotiated
• schannel: remote party requests renegotiation
• schannel: renegotiating SSL/TLS connection
• schannel: SSL/TLS connection renegotiated
• Request completely sent off
  < HTTP/1.1 401 Unauthorized
  < Server: AzureContainerRegistry
  < Date: Wed, 13 Aug 2025 04:42:21 GMT
  < Content-Type: application/json; charset=utf-8
  < Content-Length: 149
  < Connection: keep-alive
  < Access-Control-Expose-Headers: Docker-Content-Digest
  < Access-Control-Expose-Headers: WWW-Authenticate
  < Access-Control-Expose-Headers: Link
  < Access-Control-Expose-Headers: X-Ms-Correlation-Request-Id
  < Docker-Distribution-Api-Version: registry/2.0
  < Strict-Transport-Security: max-age=31536000; includeSubDomains
  < Www-Authenticate: Bearer realm="https://acragenticainova-dad4auhga8feekaq.azurecr.io/oauth2/token",service="acragenticainova-dad4auhga8feekaq.azurecr.io"
  < X-Content-Type-Options: nosniff
  < X-Ms-Correlation-Request-Id: e1df866e-fad7-4e94-be0e-30d27ec9c514
  < Strict-Transport-Security: max-age=31536000; includeSubDomains
  <
  {"errors":[{"code":"UNAUTHORIZED","message":"authentication required, visit https://aka.ms/acr/authorization for more information.","detail":null}]}
• Connection #0 to host acragenticainova-dad4auhga8feekaq.azurecr.io left intac