Login to Azure Devops Server - Failed to authenticate using the supplied token

[eliassal]

Describe the bug

I created a PAT in collection, then I run against the collection
az devops login --organization https://myAZDServer.mydomain.net/Sierac-Utilities/
or against a project inside the collection
az devops login --organization https://myAZDServer.mydomain.net/Sierac-Utilities/dotNet%20Projects
I also tired
echo "XXXXXXX2csmm636cy37wtsfpaw7eh22222222" | az devops login --organization https://azuredevops2k19.salam.net/Sierac-Utilities/

I always get

Failed to authenticate using the supplied token

I access my Azure Devops server using https, certificate valid in browsers(Edge, chrome) created by XCA certificate and key management

What might be going wrong? Thanks for your help

Related command

az devops login

Errors

Failed to authenticate using the supplied token

Issue script & Debug output

urllib3.connectionpool: Retrying (Retry(total=2, connect=3, read=3, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)'))': /Sierac-Utilities/_apis
urllib3.connectionpool: Starting new HTTPS connection (2): myserver.xxxxx.net:443
urllib3.util.retry: Incremented Retry for (url='/Sierac-Utilities/_apis'): Retry(total=1, connect=3, read=3, redirect=None, status=None)
urllib3.connectionpool: Retrying (Retry(total=1, connect=3, read=3, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)'))': /Sierac-Utilities/_apis
urllib3.connectionpool: Starting new HTTPS connection (3): myserver.xxxxx.net:443
urllib3.util.retry: Incremented Retry for (url='/Sierac-Utilities/_apis'): Retry(total=0, connect=3, read=3, redirect=None, status=None)
urllib3.connectionpool: Retrying (Retry(total=0, connect=3, read=3, redirect=None, status=None)) after connection broken by 'SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)'))': /Sierac-Utilities/_apis
urllib3.connectionpool: Starting new HTTPS connection (4): myserver.xxxxx.net:443
msrest.exceptions: Error occurred in request., SSLError: HTTPSConnectionPool(host='azuredevops2k19.salam.net', port=443): Max retries exceeded with url: /Sierac-Utilities/_apis (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')))

Expected behavior

To get logged to my Azure Devops Server collection

Environment Summary

azure-cli 2.77.0 *

core 2.77.0 *
telemetry 1.1.0

Extensions:
account 0.2.5
automation 1.0.0b1
azure-devops 1.0.2
bastion 1.4.2
containerapp 1.2.0b3
interactive 1.0.0b1
next 0.1.3
resource-graph 2.1.1
spring-cloud 3.1.8
storage-preview 1.0.0b7

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\myuser.azure'
Extensions directory 'C:\Users\myuser.azure\cliextensions'

Python (Windows) 3.13.7 (tags/v3.13.7:bcee1c3, Aug 14 2025, 14:15:11) [MSC v.1944 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

You have 2 update(s) available. Consider updating your CLI installation with 'az upgrade'

Additional context

No response

[azure-client-tools-bot-prd]

Hi @eliassal,

2.77.0 is not the latest Azure CLI(2.79.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Install pip-system-certs to make Azure CLI use the Windows system certificates. Run the following command in a Windows CMD prompt or PowerShell:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

If you have the new 64-bit installer, use:

"C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

Reference:

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)

Solution 2:

Ensure that the REQUESTS_CA_BUNDLE environment variable is either empty or pointing to the correct CA bundle. You can set it to the system CA bundle if needed:

export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt

Alternatively, unset it if it is causing issues:

unset REQUESTS_CA_BUNDLE

Reference:

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)

Solution 3:

Manually add the required certificate (e.g., ZScaler or self-signed certificates) to the certifi CA bundle used by Azure CLI. Locate the cacert.pem file in the Azure CLI installation directory and append the certificate to it. For example:

• For Azure CLI installed in C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\
• For Python installations, locate the certifi directory and modify the cacert.pem file there.

Reference:

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)

Powered by issue-sentinel