Unable to Add Account To ADS When Traffic Undergoes SSL Decryption

[Mark-Jarvis-84]

• Azure Data Studio Version: 1.51.1
• OS Version: Windows 10

Unable to add MS365 accounts in ADS when traffic undergoes SSL Decryption. The certificate being used for SSL Decryption is trusted with the root installed in the machines certificate store. We don't see this issue with any other traffic that undergoes SSL Decryption.

Does this issue occur when all extensions are disabled?: Yes

[kburtram]

Thanks for reporting this issue.

From your description, this looks like it’s related to how Node.js handles certificates when used inside Azure Data Studio (which is built on Electron). By default, Node does not use the Windows certificate store, and instead relies on its own built-in CA bundle. This means that SSL-decrypting proxies—like those used in some corporate environments—may not be trusted unless their root CA is explicitly provided.

✅ Workaround: Add Your Root CA to Node Trust
If your organization uses a custom root certificate for SSL interception, you can try setting the following environment variable before launching Azure Data Studio:

NODE_EXTRA_CA_CERTS=C:\path\to\your\corp-root.pem

Make sure the file is in PEM format (base64-encoded, starting with -----BEGIN CERTIFICATE-----), and that the path is correct for your system.

Note: This method appends your root CA to Node's internal CA bundle, allowing it to trust the cert used by your proxy.

🔍 Still Not Working? Enable Debug Logging
If the issue persists, you can get more information about how Node is handling the TLS handshake by enabling debug logging:

On Command Prompt:

set NODE_DEBUG=tls,https

On PowerShell:

$env:NODE_DEBUG="tls,https"

Then launch Azure Data Studio and reproduce the issue. This will print diagnostic output from Node’s tls and https modules to the console, including which certificates it's seeing and whether trust is failing.

⚠️ Please review the log carefully before sharing anything publicly. It may include internal domain names or certificate details specific to your environment. You can use it for your own investigation, or post only safe, redacted excerpts if you'd like help interpreting it.

Let us know how it goes!