Az CLI 2.77.0 ssl issues

[Bjego]

Describe the bug

Hi,
the az cli just got updated on the azure managed devops pools. We run it in a custom vnet with SSL inspection.
With Az CLI we set the env variable "REQUESTS_CA_BUNDLE" to our root cert.
Now the pipelines are failing, when az cli is used.

WARNING: Unable to check if your CLI is up-to-date. Check your internet connection.
Setting AZURE_CONFIG_DIR env variable to: /mnt/vss/_work/_temp/.azclitask
Setting active cloud to: AzureCloud
/usr/bin/az cloud set -n AzureCloud
/usr/bin/az login --service-principal -u *** --tenant XXXX --allow-no-subscriptions --federated-token ***
ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.
##[error]Error Code: [1]
##[error]Error: Azure login failed
##[error]Script failed with error: ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

##[error]Script failed with error: ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

Related command

az login
az acr purge
az acr run

Errors

WARNING: Unable to check if your CLI is up-to-date. Check your internet connection.
Setting AZURE_CONFIG_DIR env variable to: /mnt/vss/_work/_temp/.azclitask
Setting active cloud to: AzureCloud
/usr/bin/az cloud set -n AzureCloud
/usr/bin/az login --service-principal -u *** --tenant XXXX --allow-no-subscriptions --federated-token ***
ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.
##[error]Error Code: [1]
##[error]Error: Azure login failed
##[error]Script failed with error: ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

##[error]Script failed with error: ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

Issue script & Debug output

• task: AzureCLI@2
  inputs:
  azureSubscription: 'SOMESERVICECONNECTION'
  scriptType: 'pscore'
  scriptLocation: 'inlineScript'
  inlineScript: |
  $purgeCMD = "acr purge --filter '$(targetRepository):.*' --ago 1d --untagged --keep 1"
  az acr run --cmd "$purgeCMD" --registry REGISTRYNAME --subscription BBBB /dev/null

WARNING: Unable to check if your CLI is up-to-date. Check your internet connection.
Setting AZURE_CONFIG_DIR env variable to: /mnt/vss/_work/_temp/.azclitask
Setting active cloud to: AzureCloud
/usr/bin/az cloud set -n AzureCloud
/usr/bin/az login --service-principal -u *** --tenant XXXX --allow-no-subscriptions --federated-token ***
ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.
##[error]Error Code: [1]
##[error]Error: Azure login failed
##[error]Script failed with error: ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

##[error]Script failed with error: ERROR: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /YYYY/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

Expected behavior

The script should not throw any SSL issus

Environment Summary

/usr/bin/az --version
azure-cli 2.77.0

core 2.77.0
telemetry 1.1.0

Extensions:
azure-devops 1.0.2

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/az/bin/python3'
Config directory '/home/AzDevOps/.azure'
Extensions directory '/opt/az/azcliextensions'

Python (Linux) 3.13.7 (main, Aug 26 2025, 08:47:19) [GCC 13.3.0]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @toddysm, @northtyphoon, @luisdlp, @terencet-dev, @shizhMSFT, @JXavierMSFT.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• 2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032) #32083
• azure cli proxy connection issue from windows  #21696
• Az Login Issue: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125) #22348
• unable to login to AZ  #13032

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Grab the CA cert of the Proxy and update the cert on azure-cli - cacert.pem. Then just update the env. variable with echo REQUESTS_CA_BUNDLE=*PATH*/CACERT.PEM. Note: Perform similar steps when you upgrade the CLI version.

Reference:

• unable to login to AZ  #13032 (comment)

Solution 2:

Convert the server certificate from .cer/.crt to .pem (if not using proxy) or proxy certificate (if using proxy) using OpenSSL/Portecle or similar tools. Just renaming the certificate won't work.

Reference:

• azure cli proxy connection issue from windows  #21696 (comment)

Solution 3:

Setting $env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 works as a workaround.

Reference:

• 2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032) #32083 (comment)

Powered by issue-sentinel

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @toddysm, @northtyphoon, @luisdlp, @terencet-dev, @shizhMSFT, @JXavierMSFT.