Error while attempting to retrieve the latest Bicep version:

[chris-moceri]

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

Describe the bug
This is a reopening of #19420 the az bicep install command is once again throwing an SSL: CERTIFICATE_VERIFY_FAILED error

"Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)')))."

PS C:\WINDOWS\system32> az bicep install --debug
cli.knack.cli: Command arguments: ['bicep', 'install', '--debug']
cli.knack.cli: init debug log:
Enable color in terminal.
Init colorama.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x031D8D18>, <function OutputProducer.on_global_arguments at 0x0329C658>, <function CLIQuery.on_global_arguments at 0x032BB2B0>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'bicep': ['azure.cli.command_modules.resource']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: resource 0.013 43 197
cli.azure.cli.core: Total (1) 0.013 43 197
cli.azure.cli.core: Loaded 43 groups, 197 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : bicep install
cli.azure.cli.core: Command table: bicep install
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x03DCC220>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\chris.moceri.azure\commands\2022-04-26.10-52-35.bicep_install.16544.log'.
az_command_data_logger: command args: bicep install --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x03E03DF0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x03E03EC8>, <function register_cache_arguments..add_cache_arguments at 0x03E19460>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x0329C6A0>, <function CLIQuery.handle_query_parameter at 0x032BB2F8>, <function register_ids_argument..parse_ids_arguments at 0x03E19418>]
urllib3.connectionpool: Starting new HTTPS connection (1): aka.ms:443
cli.azure.cli.core.util: azure.cli.core.util.handle_exception is called with an exception:
cli.azure.cli.core.util: Traceback (most recent call last):
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 699, in urlopen
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 382, in make_request
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 1010, in validate_conn
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connection.py", line 416, in connect
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/ssl.py", line 449, in ssl_wrap_socket
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/ssl.py", line 493, in _ssl_wrap_socket_impl
File "ssl.py", line 512, in wrap_socket
File "ssl.py", line 1070, in _create
File "ssl.py", line 1341, in do_handshake
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/adapters.py", line 439, in send
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 755, in urlopen
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/retry.py", line 574, in increment
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/_bicep.py", line 156, in get_bicep_latest_release_tag
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/api.py", line 75, in get
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/api.py", line 61, in request
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/sessions.py", line 542, in request
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/sessions.py", line 655, in send
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/adapters.py", line 514, in send
requests.exceptions.SSLError: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 231, in invoke
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 658, in execute
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 721, in _run_jobs_serially
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 692, in _run_job
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 328, in call
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/custom.py", line 3687, in install_bicep_cli
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/_bicep.py", line 106, in ensure_bicep_installation
File "D:\a\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/_bicep.py", line 160, in get_bicep_latest_release_tag
azure.cli.core.azclierror.ClientRequestError: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)'))).

cli.azure.cli.core.azclierror: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)'))).
az_command_data_logger: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)'))).
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x03DCC340>]
az_command_data_logger: exit code: 1
cli.main: Command ran in 1.494 seconds (init: 0.564, invoke: 0.930)
telemetry.save: Save telemetry record of length 3304 in cache
telemetry.check: Negative: The C:\Users\chris.moceri.azure\telemetry.txt was modified at 2022-04-26 10:48:45.007667, which in less than 600.000000 s

To Reproduce
az bicep install

Expected behavior
bicep installs normally via the az bicep install command

Environment summary
Powershell on Windows 10

PS C:\WINDOWS\system32> az --version
azure-cli 2.36.0

core 2.36.0
telemetry 1.0.6

Dependencies:
msal 1.17.0
azure-mgmt-resource 20.0.0

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'

Python (Windows) 3.10.4 (tags/v3.10.4:9d38120, Mar 23 2022, 22:57:10) [MSC v.1929 32 bit (Intel)]

Additional context
Setting PS C:\WINDOWS\system32> $env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 has no effect

Thank you for your feedback. This has been routed to the support team for assistance.

[yonzhan]

route to CXP team

[navba-MSFT]

@chris-moceri Thanks for reaching out to us and sharing this feedback. There was a similar issue reported #20842 and then a PR was filed to fix this #21807. If you are still facing the same issue, I will look into this further and I will get back to you with an update.

[chris-moceri]

Weird, looks like it works now: PS C:\Users\chris.moceri> az bicep install Installing Bicep CLI v0.5.6... Successfully installed Bicep CLI to "C:\Users\chris.moceri\.azure\bin\bicep.exe". PS C:\Users\chris.moceri> From: navba-MSFT ***@***.***> Sent: Thursday, April 28, 2022 1:36 AM To: Azure/azure-cli ***@***.***> Cc: Chris Moceri ***@***.***>; Mention ***@***.***> Subject: Re: [Azure/azure-cli] Error while attempting to retrieve the latest Bicep version: (Issue #22194) @chris-moceri<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fchris-moceri&data=05%7C01%7Cchris.moceri%40paccar.com%7C1d63f46e30eb4ec73f4508da28f21de8%7Ce201abf9c5a343f88e29135d4fe67e6b%7C0%7C0%7C637867317592570795%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=wqe3GpATlRfehaJpSU65IsmAfEffY%2B0xQxwbgQoDwR4%3D&reserved=0> Thanks for reaching out to us and sharing this feedback. There was a similar issue reported #20842<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Fazure-cli%2Fissues%2F20842&data=05%7C01%7Cchris.moceri%40paccar.com%7C1d63f46e30eb4ec73f4508da28f21de8%7Ce201abf9c5a343f88e29135d4fe67e6b%7C0%7C0%7C637867317592570795%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=x5cBLNmjQjmFAfHRbKp26m7N%2B6eEtB6FhvprqAQmxG0%3D&reserved=0> and then a PR was filed to fix this #21807<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Fazure-cli%2Fpull%2F21807&data=05%7C01%7Cchris.moceri%40paccar.com%7C1d63f46e30eb4ec73f4508da28f21de8%7Ce201abf9c5a343f88e29135d4fe67e6b%7C0%7C0%7C637867317592570795%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=0DV1VWmJBJ1iXSIwKUVjDYqdbyGAqqWuXizWlXFMwqo%3D&reserved=0>. If you are still facing the same issue, I will look into this further and I will get back to you with an update. - Reply to this email directly, view it on GitHub<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FAzure%2Fazure-cli%2Fissues%2F22194%23issuecomment-1111903944&data=05%7C01%7Cchris.moceri%40paccar.com%7C1d63f46e30eb4ec73f4508da28f21de8%7Ce201abf9c5a343f88e29135d4fe67e6b%7C0%7C0%7C637867317592570795%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=anGEpyqd0pnSRjBCKgZk28mqd9sUYlvXB2daSzsdV9w%3D&reserved=0>, or unsubscribe<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FALSH3LQVOESGG6W43SEYGY3VHJEWZANCNFSM5UMUQVXA&data=05%7C01%7Cchris.moceri%40paccar.com%7C1d63f46e30eb4ec73f4508da28f21de8%7Ce201abf9c5a343f88e29135d4fe67e6b%7C0%7C0%7C637867317592570795%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=aEIHkPwOhTEqB9OJAhoc6Vc01Q3B0eyzi3GoFuMquEg%3D&reserved=0>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>>

[navba-MSFT]

@chris-moceri I wasn't able to reproduce this issue at my end. s mentioned in my previous comment the above PR was filed to fix such issues. if you encounter the same issue in future, feel free to reopen this thread. We would be happy to work with you again until resolution.