Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921

Closed
speedwaymickey opened this issue Jan 6, 2022 · 57 comments
Closed

az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921

speedwaymickey opened this issue Jan 6, 2022 · 57 comments
Assignees
@jiasli
Labels
Account az login/account customer-reported Issues that are reported by GitHub users external to the Azure organization. feature-request
Milestone
Backlog

Comments

@speedwaymickey
Copy link

speedwaymickey commented Jan 6, 2022 •
edited
Loading

This is autogenerated. Please review and update as needed.

Describe the bug

Fresh install of azure-cli 2.32.0. When I run az login, I get the following error:

HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125)')))
az_command_data_logger: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://docs.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

No proxy is defined on this system.

This occurs with my local ISP at home, as well as the hotspot on my phone. I get the same error if I call az upgrade

If I run 'az --version', I will get the error:

'Unable to check if your CLI is up-to-date. Check your internet connection.'

I have removed all know python installation on my machine before I installed azure cli.

I will attach a debug file.

I also set the following environment variable, and that did not affect the response:

$Env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1
$Env:ADAL_PYTHON_SSL_NO_VERIFY=1

Command Name
az login

Errors:

HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1125)')))

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

  • Open Powershell as an Administrator
  • az login --debug

Expected Behavior

Environment Summary

Windows-10-10.0.19041-SP0
Version 21H1 (OS Build 19043.1415)
Python 3.8.9
Installer: MSI

azure-cli 2.32.0

Additional Context

az.login.debug.log
@ghost ghost added needs-triage This is a new issue that needs to be triaged to the appropriate team. question The issue doesn't require a change to the product in order to be resolved. Most issues start as that customer-reported Issues that are reported by GitHub users external to the Azure organization. labels Jan 6, 2022
@yonzhan yonzhan added the Account az login/account label Jan 6, 2022
@ghost ghost removed the needs-triage This is a new issue that needs to be triaged to the appropriate team. label Jan 6, 2022
@yonzhan yonzhan removed the question The issue doesn't require a change to the product in order to be resolved. Most issues start as that label Jan 6, 2022
@yonzhan yonzhan added this to the Backlog milestone Jan 6, 2022
@yonzhan
Copy link
Collaborator

yonzhan commented Jan 6, 2022

@jiasli for awareness

@jiasli
Copy link
Member

jiasli commented Jan 7, 2022

These 2 env vars don't work with MSAL-based Azure CLI:

$Env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1
$Env:ADAL_PYTHON_SSL_NO_VERIFY=1

Please check if you are able to access https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration with

  • Web browser
  • & "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -c "import requests; print(requests.get('https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration').status_code)"

Also, in the web browser, please check if the certificate chain is correct. It should look like:

image

You may follow an article I wrote: https://github.com/jiasli/azure-notes/blob/master/cli/cli-proxy.md

@speedwaymickey
Copy link
Author

speedwaymickey commented Jan 7, 2022 via email •
edited
Loading

@jiasli
Copy link
Member

jiasli commented Jan 7, 2022 •
edited
Loading

Your image is trimmed. Please directly reply in GitHub website.

@speedwaymickey
Copy link
Author

image

@jiasli
Copy link
Member

jiasli commented Jan 7, 2022

The certificate looks good. However, as Python itself can't access https://login.microsoftonline.com/, could you also check your env var for whether HTTP_PROXY or HTTPS_PROXY is set?

ls env:

If so, could you clear them?

image

@speedwaymickey
Copy link
Author

HTTP_PROXY and HTTPS_PROXY are not set, and are not returned via:

ls env:

@sanjeev40084
Copy link

i am running into same issue too :( both HTTP_PROXY and HTTPS_PROXY values are not set for me too.

@speedwaymickey
Copy link
Author

Any progress on this? Is this an incompatibility between:

Windows-10-10.0.19041-SP0 Version 21H1 (OS Build 19043.1415)

and

Python 3.8.9

@jiasli
Copy link
Member

jiasli commented Jan 12, 2022

As Python itself can't connect to internet, there must be some proxy, otherwise Azure CLI won't work for other users...

Could you also check the result of

& "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -c "import urllib.request; print(urllib.request.getproxies())"

Also, what is the the proxy setting in Control Panel -> Internet Options -> Connections -> LAN settings:

image

@speedwaymickey
Copy link
Author

PS C:\WINDOWS\system32> & "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -c "import urllib.request; print(urllib.request.getproxies())"
{}

image

image

Same results whether I am connected to my companies VPN or not.

@jiasli
Copy link
Member

jiasli commented Jan 12, 2022

Have you manually edited C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem and deleted existing entries?

I got the same error after deleting some entries in that file:

image

You may try to re-install Azure CLI.

@speedwaymickey
Copy link
Author

  • I uninstalled azure-cli and verified that C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem and folder was removed.
  • Rebooted my computer.
  • I then installed azure-cli via azure-cli-2.32.0.msi.
  • Rebooted my computer.
  • I then ran az login in PowerShell

I continue to get the error:

image

I do not see the message "The default web browser has been opend at: ..."

It fails before the attempt to open the browser.

@jiasli
Copy link
Member

jiasli commented Jan 12, 2022

It fails before the attempt to open the browser.

Yes, this is the expected behavior as I have MSAL HTTP cache.

After deleting ~/.azure/msal_http_cache.bin, I got the same error:

image

If you download and install Python directly from https://www.python.org/downloads/ and install requests, can this issue be reproduced?

pip install requests
python -c "import requests; print(requests.get('https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration').status_code)"

@speedwaymickey
Copy link
Author

I installed the latest version, 3.10.1, directly from the python web site, and ran pip install requests, and get a similar error:

image

@speedwaymickey
Copy link
Author

I was able to install the requests pack via the following command:

pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org requests

When run:

python -c "import requests; print(requests.get('https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration').status_code)"

I get the following error:

PS C:\WINDOWS\system32> python -c "import requests; print(requests.get('https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration').status_code)"
Traceback (most recent call last):
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 703, in urlopen
httplib_response = self._make_request(
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 386, in _make_request
self._validate_conn(conn)
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 1040, in validate_conn
conn.connect()
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connection.py", line 416, in connect
self.sock = ssl_wrap_socket(
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\util\ssl.py", line 449, in ssl_wrap_socket
ssl_sock = ssl_wrap_socket_impl(
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\util\ssl.py", line 493, in _ssl_wrap_socket_impl
return ssl_context.wrap_socket(sock, server_hostname=server_hostname)
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\ssl.py", line 512, in wrap_socket
return self.sslsocket_class._create(
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\ssl.py", line 1070, in _create
self.do_handshake()
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\ssl.py", line 1341, in do_handshake
self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\adapters.py", line 440, in send
resp = conn.urlopen(
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\connectionpool.py", line 785, in urlopen
retries = retries.increment(
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\urllib3\util\retry.py", line 592, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "", line 1, in
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\api.py", line 75, in get
return request('get', url, params=params, **kwargs)
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\api.py", line 61, in request
return session.request(method=method, url=url, **kwargs)
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\sessions.py", line 529, in request
resp = self.send(prep, **send_kwargs)
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\sessions.py", line 645, in send
r = adapter.send(request, **kwargs)
File "C:\Users<user>\AppData\Local\Programs\Python\Python310\lib\site-packages\requests\adapters.py", line 517, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)')))

@jiasli
Copy link
Member

jiasli commented Jan 13, 2022

@speedwaymickey, this indicates Python itself is not able to connect to the internet. Even pypi.org and files.pythonhosted.org's TLS verification doesn't work.

Perhaps you can submit your question to https://bugs.python.org/ or https://stackoverflow.com/.

@jiasli
Copy link
Member

jiasli commented Jan 13, 2022

I would also suggest you to try openssl and see if the certificate is returned correct:

openssl s_client -showcerts -servername login.microsoftonline.com -connect login.microsoftonline.com:443

It may also be possible that your browser is actually using a proxy that doesn't intercept HTTPS traffic, all other HTTPS traffic (from Python, openssl) are intercepted by your company proxy.

@speedwaymickey
Copy link
Author

I currently don't have openssl on my laptop, that doesn't work, or my VM that does work.

I can install it and give it try.

Note: I am not convinced that the browser has anything to do with this problem as it doesn't appear to be an attempt to open the browser.

I am not connected to my companies network or VPN. Just my ISP.

@speedwaymickey
Copy link
Author

I can post the entire output from openssl if it doesn't disclose any private information. But I am seeing information like:

PS C:\WINDOWS\system32> openssl s_client -showcerts -servername login.microsoftonline.com -connect login.microsoftonline.com:443
CONNECTED(000001B8)
depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
verify return:1

Certificate chain
0 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Dec 6 00:00:00 2021 GMT; NotAfter: Dec 6 23:59:59 2022 GMT

and

SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: E21700008D8C61CEF2969E18185DA392E54CCB2869B0B907C82A388FE16DF7C3
Session-ID-ctx:
Master-Key:
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1642043712
Timeout : 7200 (sec)
Verify return code: 20 (unable to get local issuer certificate)
Extended master secret: yes

read:errno=10054

@jiasli
Copy link
Member

jiasli commented Jan 13, 2022

I am not convinced that the browser has anything to do with this problem as it doesn't appear to be an attempt to open the browser.

I am referring to the test we did in #20921 (comment).

Looks like openssl indeed got the right certificate:

depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
verify return:1

How about when -CAfile is specified, it should look like

> echo Q | openssl s_client -showcerts -servername login.microsoftonline.com -connect login.microsoftonline.com:443 -CAfile "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem"
CONNECTED(000001A4)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
   i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
-----BEGIN CERTIFICATE-----
MIIH1TCCBr2gAwIBAgIQAa7dVAEcBRw+RJ57pU+uUTANBgkqhkiG9w0BAQsFADBN
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMjExMTMwMDAwMDAwWhcN
MjIxMTMwMjM1OTU5WjB/MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
aW9uMSkwJwYDVQQDEyBzdGFtcDIubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN0ZVzMwsZ0kjBfSVi0K0e8p
8NLWfbkRxikNwrmjiB9OEl5AwT5nJUArH/xWxVnw0XeJO8acVkhav9wZaR8XXvgN
g7KyDjIctf4vgPyqF24RYbmUyGn1pkDjSA+wCyZEQvDulSojMttpSY9N4S5Od1S9
FF31w9/Tgb0VqhvNhXl8mGDHejkyM1BuS0Z5hdG9HBbzOG180OX5YAs8zN/U8+DC
ZWJD/9tRLXGwHKWaX8AMIRHggT+qtr3LiDM/IjV30NP+tItTfhflsUqmwBEl4dRQ
l9Gp9fflOrQ+Z1qYDBAzD5W3aK7qgxPVTnSWd9FnM3wTJ85epEVwfUUDgreiCIEC
AwEAAaOCBH0wggR5MB8GA1UdIwQYMBaAFA+AYRyCMWHVLyjnjUY4tCzhxtniMB0G
A1UdDgQWBBQJY92+q+aspd74tVKdzvrJGVxjizCCASYGA1UdEQSCAR0wggEZgh1s
b2dpbi5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIbbG9naW4ubWljcm9zb2Z0b25s
aW5lLXAuY29tghlsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tgh5sb2dpbjIubWlj
cm9zb2Z0b25saW5lLWludC5jb22CGmxvZ2luMi5taWNyb3NvZnRvbmxpbmUuY29t
gh9sb2dpbmV4Lm1pY3Jvc29mdG9ubGluZS1pbnQuY29tghtsb2dpbmV4Lm1pY3Jv
c29mdG9ubGluZS5jb22CJHN0YW1wMi5sb2dpbi5taWNyb3NvZnRvbmxpbmUtaW50
LmNvbYIgc3RhbXAyLmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20wDgYDVR0PAQH/
BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjCBjQYDVR0fBIGF
MIGCMD+gPaA7hjlodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaWNlcnRTSEEy
U2VjdXJlU2VydmVyQ0EtMS5jcmwwP6A9oDuGOWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0
LmNvbS9EaWdpY2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS0xLmNybDA+BgNVHSAENzA1
MDMGBmeBDAECAjApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNv
bS9DUFMwfgYIKwYBBQUHAQEEcjBwMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k
aWdpY2VydC5jb20wSAYIKwYBBQUHMAKGPGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0
LmNvbS9EaWdpQ2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS0yLmNydDAMBgNVHRMBAf8E
AjAAMIIBfgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdgApeb7wnjk5IfBWc59jpXfl
vld9nGAK+PlNXSZcJV3HhAAAAX1ywKK2AAAEAwBHMEUCIGmN7+uqi5WtGVgmnyw5
ACGqmiMA8KxPKKMwCI4shVz/AiEAwbWormNTAjM7zVRMTQgV/zczCN9KgZseT80d
TF/nlMAAdQBRo7D1/QF5nFZtuDd4jwykeswbJ8v3nohCmg3+1IsF5QAAAX1ywKJ4
AAAEAwBGMEQCIAaAGOw4ocJH2tnfuPBaUvBaayVWUcH7W2aC5vD/qDsvAiB2Wdey
Rqo2ZD2bNwA/0U6ROZk1zhDJJNiErs/cQHe4nwB3AEHIyrHfIkZKEMahOglCh15O
MYsbA+vrS8do8JBilgb2AAABfXLAoxMAAAQDAEgwRgIhAIlz+fO1zzPenZyB2/eW
uGtzxiKzaTEUOMfe6ex3QZnLAiEA2yN+x48ySFhFeSp1DEP1ocdqA+zJWQLpDril
s4nbyDwwDQYJKoZIhvcNAQELBQADggEBABlROlw6+CskNGwt4EwJ3ykHRihzhE3U
xH5v3h9Jrfsx9Ze/GolY3HLJcFJX6lbZHMM/IN9qLsm9TCxzGRMj4huPTXSIiuiU
qPXgmn7Dt6QxBnGu3ed0zonI2MFpsaVkiIEHokNQQGAepH0euKQmKmUcE5aMeyDw
BtOf59T1zszpmD83/DsjKDNSUr9p3bxGFuc/67ymI9neN0dderZGlmPOKXAfEo5Y
ilIpGrWqWipcphJiHXU5p1t79RyPV5mDHb8m/0OPpahHUQweSA+rMak6si8eE6b7
sYEJGgVvSCdQpuStA4w3S7/OE8EB9REO7/nQMyvIRFX1Ys8ILo1DDCQ=
-----END CERTIFICATE-----
 1 s:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
   i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
-----BEGIN CERTIFICATE-----
MIIE6DCCA9CgAwIBAgIQAnQuqhfKjiHHF7sf/P0MoDANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0yMDA5MjMwMDAwMDBaFw0zMDA5MjIyMzU5NTlaME0xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAa4wggGqMB0GA1UdDgQWBBQPgGEcgjFh
1S8o541GOLQs4cbZ4jAfBgNVHSMEGDAWgBQD3lA1VtFMu2bwo+IbG8OXsj3RVTAO
BgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIG
A1UdEwEB/wQIMAYBAf8CAQAwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhho
dHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNl
cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcnQwewYDVR0f
BHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xv
YmFsUm9vdENBLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0Rp
Z2lDZXJ0R2xvYmFsUm9vdENBLmNybDAwBgNVHSAEKTAnMAcGBWeBDAEBMAgGBmeB
DAECATAIBgZngQwBAgIwCAYGZ4EMAQIDMA0GCSqGSIb3DQEBCwUAA4IBAQB3MR8I
l9cSm2PSEWUIpvZlubj6kgPLoX7hyA2MPrQbkb4CCF6fWXF7Ef3gwOOPWdegUqHQ
S1TSSJZI73fpKQbLQxCgLzwWji3+HlU87MOY7hgNI+gH9bMtxKtXc1r2G1O6+x/6
vYzTUVEgR17vf5irF0LKhVyfIjc0RXbyQ14AniKDrN+v0ebHExfppGlkTIBn6rak
f4994VH6npdn6mkus5CkHBXIrMtPKex6XF2firjUDLuU7tC8y7WlHgjPxEEDDb0G
w6D0yDdVSvG/5XlCNatBmO/8EznDu1vr72N8gJzISUZwa6CCUD7QBLbKJcXBBVVf
8nwvV9GvlW+sbXlr
-----END CERTIFICATE-----
---
Server certificate
subject=C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com

issuer=C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, P-384, 384 bits
---
SSL handshake has read 3796 bytes and written 485 bytes
Verification: OK
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: 9022000079D7D0585C858442F30508D3956D1570D87C0EC3037AFBDB99FB7D6B
    Session-ID-ctx:
    Master-Key: 8BFDD2897CD139F47DC056EBE0A26AE328427EDD7B7A3F8D62BDDE8E93268C7472714C4D61385FC315D555EE3315B12A
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1642044782
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: yes
---
DONE

@speedwaymickey
Copy link
Author

That seems to look okay:

PS C:\WINDOWS\system32> echo Q | openssl s_client -showcerts -servername login.microsoftonline.com -connect login.microsoftonline.com:443 -CAfile "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem"
CONNECTED(000001A0)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
verify return:1
depth=0 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
verify return:1

Certificate chain
0 s:C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
i:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Dec 3 00:00:00 2021 GMT; NotAfter: Dec 3 23:59:59 2022 GMT
-----BEGIN CERTIFICATE-----
MIIH1TCCBr2gAwIBAgIQCwmupKowBthJrq95tqj5HzANBgkqhkiG9w0BAQsFADBN
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5E
aWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMjExMjAzMDAwMDAwWhcN
MjIxMjAzMjM1OTU5WjB/MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
aW9uMSkwJwYDVQQDEyBzdGFtcDIubG9naW4ubWljcm9zb2Z0b25saW5lLmNvbTCC
ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANWWmPr63W1xFoeEGc7k031J
h1/w6pPniPXwmBo4HK+7a4WyVO7loRlRXmmapLgBRGFFDZr0oSD1JsW89Svvl25R
czq0x8EeasOhHsnbgDFVurxDnQkZSVza65FLk24yHNRJkQSCW+NN0wNDQt6aFTJt
FxTY5Bu1cbo1zpVKaIwPI2aOWCTqIzq7nVmpZIhKUMQXX2KU1FK0MkuEIATObKsE
mt2XZ7Lx+cEQrY0jqnGik500b67KTm3vBrQjZez82lUCnwnYHNbazDbiOlWjtojT
nblznOrcJwFPyKzu+FARcJ9olkqxQ5vh5JcgdDicqVlnstgD/f/SxcH7NThODDkC
AwEAAaOCBH0wggR5MB8GA1UdIwQYMBaAFA+AYRyCMWHVLyjnjUY4tCzhxtniMB0G
A1UdDgQWBBTqyburHCqkzFq0JjGNy7I3Ln9HjTCCASYGA1UdEQSCAR0wggEZgh1s
b2dpbi5taWNyb3NvZnRvbmxpbmUtaW50LmNvbYIbbG9naW4ubWljcm9zb2Z0b25s
aW5lLXAuY29tghlsb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tgh5sb2dpbjIubWlj
cm9zb2Z0b25saW5lLWludC5jb22CGmxvZ2luMi5taWNyb3NvZnRvbmxpbmUuY29t
gh9sb2dpbmV4Lm1pY3Jvc29mdG9ubGluZS1pbnQuY29tghtsb2dpbmV4Lm1pY3Jv
c29mdG9ubGluZS5jb22CJHN0YW1wMi5sb2dpbi5taWNyb3NvZnRvbmxpbmUtaW50
LmNvbYIgc3RhbXAyLmxvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20wDgYDVR0PAQH/
BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjCBjQYDVR0fBIGF
MIGCMD+gPaA7hjlodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaWNlcnRTSEEy
U2VjdXJlU2VydmVyQ0EtMS5jcmwwP6A9oDuGOWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0
LmNvbS9EaWdpY2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS0xLmNybDA+BgNVHSAENzA1
MDMGBmeBDAECAjApMCcGCCsGAQUFBwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNv
bS9DUFMwfgYIKwYBBQUHAQEEcjBwMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5k
aWdpY2VydC5jb20wSAYIKwYBBQUHMAKGPGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0
LmNvbS9EaWdpQ2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS0yLmNydDAMBgNVHRMBAf8E
AjAAMIIBfgYKKwYBBAHWeQIEAgSCAW4EggFqAWgAdgApeb7wnjk5IfBWc59jpXfl
vld9nGAK+PlNXSZcJV3HhAAAAX2A9N8cAAAEAwBHMEUCIFkmYFC2l3xlBjTq+rJU
FEJTSDnZSBTTvcvOoAgrJ794AiEAy46BG7a20O7BRgGOR2J6GCQiBlAIgbyq2Rgo
E1xfy4gAdwBRo7D1/QF5nFZtuDd4jwykeswbJ8v3nohCmg3+1IsF5QAAAX2A9N+B
AAAEAwBIMEYCIQCaG8HAh8hlANnPinbJHL3Sd9Fvtxh/TQ6tq49g/xrg+wIhAKj2
M6Mwjf8AIM7Yx3+FKd4hnIwgZyakfPwNU60qSx6/AHUAQcjKsd8iRkoQxqE6CUKH
Xk4xixsD6+tLx2jwkGKWBvYAAAF9gPTfTAAABAMARjBEAiApFIZs8MmhJogvT+/N
OPaGRGGvdSFPLYc3GXnasY5ssQIgCXRFlZJ2a/0KBhSe/YfWAI33f4eGXQMzd/dQ
R7VmZWIwDQYJKoZIhvcNAQELBQADggEBANDbJZCgqvLt6cr0HHKz3M1k4mqw7eFW
0GfL/k46qwluzy7bBbcNu3UIisu9T6QvgIS8A1c4pq2ATo2x81G3C7zG8ZEDmiFQ
zct1ePLi+UiycN/Kf4sVZkOlyGsz+41wNATA1o7z+BZh6PMMrgVj46dAtUNfm+se
ugYAvRhCRYQI4ef9l0iuI8X4zMJ51XpGYTn+xg35bIlXYpVfVj4WKj0mI6E85mdu
6kRcQBBapLBEK4qSCJ8RjF9f95EcdNWqRDx8tOXSfqZrHOhC/vniKm8N0DvkCKry
aMWwhl1VMCSlqT6+wGC9vP3X6jQ9zRd4vQr/Y8JPr9e4Vhx6+Qy0y6s=
-----END CERTIFICATE-----
1 s:C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root CA
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Sep 23 00:00:00 2020 GMT; NotAfter: Sep 22 23:59:59 2030 GMT
-----BEGIN CERTIFICATE-----
MIIE6DCCA9CgAwIBAgIQAnQuqhfKjiHHF7sf/P0MoDANBgkqhkiG9w0BAQsFADBh
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
QTAeFw0yMDA5MjMwMDAwMDBaFw0zMDA5MjIyMzU5NTlaME0xCzAJBgNVBAYTAlVT
MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxJzAlBgNVBAMTHkRpZ2lDZXJ0IFNIQTIg
U2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
ANyuWJBNwcQwFZA1W248ghX1LFy949v/cUP6ZCWA1O4Yok3wZtAKc24RmDYXZK83
nf36QYSvx6+M/hpzTc8zl5CilodTgyu5pnVILR1WN3vaMTIa16yrBvSqXUu3R0bd
KpPDkC55gIDvEwRqFDu1m5K+wgdlTvza/P96rtxcflUxDOg5B6TXvi/TC2rSsd9f
/ld0Uzs1gN2ujkSYs58O09rg1/RrKatEp0tYhG2SS4HD2nOLEpdIkARFdRrdNzGX
kujNVA075ME/OV4uuPNcfhCOhkEAjUVmR7ChZc6gqikJTvOX6+guqw9ypzAO+sf0
/RR3w6RbKFfCs/mC/bdFWJsCAwEAAaOCAa4wggGqMB0GA1UdDgQWBBQPgGEcgjFh
1S8o541GOLQs4cbZ4jAfBgNVHSMEGDAWgBQD3lA1VtFMu2bwo+IbG8OXsj3RVTAO
BgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMBIG
A1UdEwEB/wQIMAYBAf8CAQAwdgYIKwYBBQUHAQEEajBoMCQGCCsGAQUFBzABhhho
dHRwOi8vb2NzcC5kaWdpY2VydC5jb20wQAYIKwYBBQUHMAKGNGh0dHA6Ly9jYWNl
cnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydEdsb2JhbFJvb3RDQS5jcnQwewYDVR0f
BHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xv
YmFsUm9vdENBLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0Rp
Z2lDZXJ0R2xvYmFsUm9vdENBLmNybDAwBgNVHSAEKTAnMAcGBWeBDAEBMAgGBmeB
DAECATAIBgZngQwBAgIwCAYGZ4EMAQIDMA0GCSqGSIb3DQEBCwUAA4IBAQB3MR8I
l9cSm2PSEWUIpvZlubj6kgPLoX7hyA2MPrQbkb4CCF6fWXF7Ef3gwOOPWdegUqHQ
S1TSSJZI73fpKQbLQxCgLzwWji3+HlU87MOY7hgNI+gH9bMtxKtXc1r2G1O6+x/6
vYzTUVEgR17vf5irF0LKhVyfIjc0RXbyQ14AniKDrN+v0ebHExfppGlkTIBn6rak
f4994VH6npdn6mkus5CkHBXIrMtPKex6XF2firjUDLuU7tC8y7WlHgjPxEEDDb0G
w6D0yDdVSvG/5XlCNatBmO/8EznDu1vr72N8gJzISUZwa6CCUD7QBLbKJcXBBVVf
8nwvV9GvlW+sbXlr
-----END CERTIFICATE-----

Server certificate
subject=C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = stamp2.login.microsoftonline.com
issuer=C = US, O = DigiCert Inc, CN = DigiCert SHA2 Secure Server CA

No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: ECDH, secp384r1, 384 bits

SSL handshake has read 3796 bytes and written 489 bytes
Verification: OK

New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: F708000070A74F23553BC0F83F270A0EEE368300611C2DA1B61510D357B8C899
Session-ID-ctx:
Master-Key: 57EBD9D61F9E8E7D51A9F66E146F1B566683277A1049444F128E9464804E2BACD98F7B073270F15E635D5FBC8DA0D78B
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1642045152
Timeout : 7200 (sec)
Verify return code: 0 (ok)
Extended master secret: yes

DONE

@jiasli
Copy link
Member

jiasli commented Jun 14, 2022

@odoo-ce-modules, this is usually due to incomplete certificate chain in REQUESTS_CA_BUNDLE. You may check which URL fails with --debug and check whether the certificate chain is complete.

@jgentil
Copy link

jgentil commented Jul 20, 2022

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.

On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

(you may need to do this as administrator, or change the path depending on how you installed the CLI)

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

@jeffchiou
Copy link

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.

On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

(you may need to do this as administrator, or change the path depending on how you installed the CLI)

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

This worked for me - fixed SSL error when installing extensions.

@jeffchiou jeffchiou mentioned this issue Jul 21, 2022
Closed
@Joeboyc2
Copy link

Joeboyc2 commented Jul 28, 2022 •
edited
Loading

I tried all of the steps above in this ticket with varied degrees of success, however after running this last command: "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs
all is now well and I get the correct response from the command :)
Thank you @jgentil

@TommyJab
Copy link

TommyJab commented Aug 30, 2022 •
edited
Loading

thank you very much

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.

On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

(you may need to do this as administrator, or change the path depending on how you installed the CLI)

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

Thank you very much for your solution, you save me from madness.
Just for information, this command line works only in admistrator mode.

Best regards,

@codeecyy codeecyy mentioned this issue Nov 2, 2022
Closed
@spoelstraethan
Copy link

@jgentil @jeffchiou @Joeboyc2 @TommyJab does this survive az upgrade when moving between versions of the Azure CLI?

I'd like to avoid folks having to re-run this command periodically to fix az upgrade due to the outcome of az upgrade.

The downside of dumping a cert bundle and using that instead of the system certs is if the system cert store is managed by IT you still might have changing trusts that require you to export a new bundle (though the bundle option can fix Python/npm/et al if you set the right environment variables).

@CK-Yong
Copy link

CK-Yong commented Mar 17, 2023 •
edited
Loading

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.
On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

Had this same issue while trying to install an extension into azure CLI. Worked nicely on my macbook M1 2021. Had to use az --version and replace the python path with the path that was displayed. Thank you so much!

@paulliu10 paulliu10 mentioned this issue Mar 22, 2023
Closed
@ColinBe95
Copy link

Thank you so much, installing pip-system-certs as suggested by @jgentil worked for me. However, I had to make sure pypi is trusted (as suggested by @speedwaymickey). After running:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install --trusted-host pypi.org --trusted-host files.pythonhosted.org pip-system-certs

I got the az cli to work again :) Thank you very much!

@TheSeer507
Copy link

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.

On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

(you may need to do this as administrator, or change the path depending on how you installed the CLI)

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

You absolute legend, saved me from madness....my pc, almost agonizing after all the RAM was depleted with 20+ chrome tabs open, my eyes...weary and teary reading another time the documentation squinting my eyes to see if I missed something, alas I had given hope. Thank you, this solved my issue. Kudos to you!

@jiasli
Copy link
Member

jiasli commented May 25, 2023

Using pip-system-certs instead of certifi is tracked by #26456.

Using pip-system-certs is currently not officially supported by Azure CLI. Modifying the certifi.where() CA bundle or using REQUESTS_CA_BUNDLE to specify the CA bundle is currently the only supported approach.

@alexkusuma
Copy link

@speedwaymickey are you using ZScaler? If you do, that's the cause. ZScaler ca isn't recognised by azure CLI.

@speedwaymickey
Copy link
Author

speedwaymickey commented Aug 18, 2023 via email

@u362jsim
Copy link

My issue was actually ZScaler. Kind of weird since all of my other az cli commands were working fine until az storage blob copy start

@borjamunozf
Copy link

Hello. I'm having the same issue when running this command:

az extension add --name azure-devops

I have Azure Cli installed from PIP:

pip install azure-cli
az login

works.

Also using ZScaler.

Tested all workarounds without success:

  • pip install pip-system-certs
  • modifiyng the certify/cacert.pem adding Zscaler.
  • setting HTTP_PROXY
  • disabling AZURE_CLI_DISABLE_VERIFICATION
  • setting SSL_CERT to Zscaler.crt/pem

Any idea how to fix this?

@u362jsim how did you fix with Zscaler?

@ynden
Copy link
Contributor

ynden commented Sep 11, 2023 via email

@u362jsim
Copy link

u362jsim commented Sep 11, 2023 •
edited
Loading

@u362jsim how did you fix with Zscaler?

Unfortunately, I didn't have much need right now, so I just temporarily disabled it to get my tests working. If I need to do further troubleshooting, I'll try what @ynden suggested above!

@alexkusuma
Copy link

Hello. I'm having the same issue when running this command:

az extension add --name azure-devops

I have Azure Cli installed from PIP:

pip install azure-cli
az login

works.

Also using ZScaler.

Tested all workarounds without success:

  • pip install pip-system-certs
  • modifiyng the certify/cacert.pem adding Zscaler.
  • setting HTTP_PROXY
  • disabling AZURE_CLI_DISABLE_VERIFICATION
  • setting SSL_CERT to Zscaler.crt/pem

Any idea how to fix this?

@u362jsim how did you fix with Zscaler?

Hi @borjamunozf I wrote how I sort out the ZScaler cert issue in my blog: https://medium.com/@alextjahjana/ssl-issue-with-aws-cli-azure-cli-and-python-5cadd5ac07c4

@borjamunozf
Copy link

borjamunozf commented Sep 12, 2023 •
edited
Loading

  1. Executed & got 200.
& C:\Users\XXX\AppData\Local\Programs\Python\Python311\python.exe  -c "import requests; print(requests.certs.where())"
  1. Executed & got 200.
& C:\Users\XXX\AppData\Local\Programs\Python\Python311\python.exe -c "import requests; print(requests.get('https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration', verify=r'C:\Users\XXX\AppData\Local\Programs\Python\Python311\Lib\site-packages\certifi\cacert.pem').status_code
  1. Check $Env:REQUESTS_CA_BUNDLE. In a fresh terminal is empty, but I had already checked in another tests. Anyway, I updated $ENV_REQUESTS_CA_BUNDLE & tried again. Same error:
$Env:REQUESTS_CA_BUNDLE = "C:\Users\XXX\AppData\Local\Programs\Python\Python311\Lib\site-packages\certifi\cacert.pem"

az extension add --name azure-devops

imagen

I have tried your solution @alexkusuma but it does not work for me neither.

@ynden
Copy link
Contributor

ynden commented Sep 12, 2023 •
edited
Loading

Hey @borjamunozf, could you try using the python.exe located in the Azure CLI directory just to make sure, something that looks like this:

& "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe"

I noticed you used the python.exe in C:\Users\XXX\AppData\Local\Programs\Python\Python311\python.exe

If you don't find it, try to install it from the official .msi: https://learn.microsoft.com/en-us/cli/azure/install-azure-cli-windows?tabs=azure-cli

@alexkusuma
Copy link

alexkusuma commented Sep 12, 2023 •
edited
Loading

@borjamunozf have you tried to add the zscaler self signed cert into every certifi\cacert.pem that exists in your machine? each python installation uses their own certifi\cacert.pem.
Try add ZScaler self-signed cert into cacert.pem in your C:\Users\XXX\AppData\Local\Programs\Python\Python311\Lib\site-packages\certifi\ folder, as well as the cacert.pem in your Azure CLI folder: either in C:\Program Files(x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\ or C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\ ?

I add zscaler into my cacert,pem in c:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\ and I can add the devops extension:
image

@squaricdot
Copy link

Turns out i had to unset any of these Env vars:

1012 unset CURL_CA_BUNDLE
1013 unset REQUESTS_CA_BUNDLE
1014 unset HTTPLIB2_CA_CERTS

@borjamunozf
Copy link

borjamunozf commented Oct 10, 2023 via email

@EnjoyTheNoise
Copy link

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.

On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

(you may need to do this as administrator, or change the path depending on how you installed the CLI)

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

Just to add to this fantastic solution by @jgentil - in my case pip was unfortunately blocked by corporate firewall (and it takes ages to unblock anything). If you're in same position, you can always download whl file for pip-system certs from pypi.org and then just install it from local directory:

&"your_az_cli_python" -m pip install ./some_path/pip_system_certs-4.0-py2.py3-none-any.whl

Please note that pip-system-certs depends on wrapt package, but it actually comes with az cli itself, so you don't need to install it. Also be sure to verify az cli python path with az --version (look for Python location)

@cuntoulishifu
Copy link

It seems really silly that Microsoft's own CLI tool doesn't use pip-system-certs to support reading the certificate store from Windows itself.
On a Windows CMD prompt or in PowerShell, run this command:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

(you may need to do this as administrator, or change the path depending on how you installed the CLI)
This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

Just to add to this fantastic solution by @jgentil - in my case pip was unfortunately blocked by corporate firewall (and it takes ages to unblock anything). If you're in same position, you can always download whl file for pip-system certs from pypi.org and then just install it from local directory:

&"your_az_cli_python" -m pip install ./some_path/pip_system_certs-4.0-py2.py3-none-any.whl

Please note that pip-system-certs depends on wrapt package, but it actually comes with az cli itself, so you don't need to install it. Also be sure to verify az cli python path with az --version (look for Python location)

It works for me, thants a lot for helping me out!😁

@b0bu
Copy link

b0bu commented Jun 1, 2024

This happend to me on linux, the reason was because the first call to login.microsoftonline.com was being intercepted and needed a specific root ca to complete the call, once authenticated there's a callback to management.azure.com to download tenant and subscription info, this was not being intercepted but I had set REQUESTS_CA_BUNDLE=/mypath/certifi/cacert.pem which only had the specific ca bundle to use for interception. So first call completed, second failed.

I loaded my system store with the interception bundle properly and set azcli bundle to the system store so it could handle both calls REQUESTS_CA_BUNDLE=/etc/pki/tls/cert.pem. Paths may vary.

@niloiturra
Copy link

I tried all of the steps above in this ticket with varied degrees of success, however after running this last command: "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs all is now well and I get the correct response from the command :) Thank you @jgentil

This work for me too!

@Bea07
Copy link

Bea07 commented Jun 24, 2024

[SSL: CERTIFICATE_VERIFY_FAILED]? I solved doing pip install pip-system-certs in your python environment !!! this works fine for enterprise extra certificates that stay th the middle of normal api communications.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jiasli jiasli

Labels
Account az login/account customer-reported Issues that are reported by GitHub users external to the Azure organization. feature-request
Projects
None yet
Milestone
Backlog
Development

No branches or pull requests