Share via

Azure cli behind corporate proxy not working (SSL: WRONG_VERSION_NUMBER)

Lavrenty Eskin 1 Reputation point
2021-12-22T18:25:45.547+00:00

I have my C:\Users\xxxx\cacert-with-corp-proxy-cert.pem file updated with corporate ssl proxy certificate. To confirm that pem file updated properly and corporate proxy ssl certificates are valid I performed the check with python.exe (Microsoft SDKs\Azure\CLI2\python.exe):

import urllib.request
import ssl
import certifi
import requests
url = "https://www.google.com/"

this one works:
html = urllib.request.urlopen(url, context=ssl.create_default_context(cafile="C:\Users\xxxx\cacert-with-corp-proxy-cert.pem"))
this one doesn't work (as expected):
html = urllib.request.urlopen(url, context=ssl.create_default_context(cafile="C:\Users\xxxx\cacert-default.pem"))

But, when I am trying to use REQUESTS_CA_BUNDLE="C:\Users\xxxx\cacert-with-corp-proxy-cert.pem" with az login command I see the following error:

Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy. Error detail: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /common/oauth2/token (Caused by SSLError(SSLError(1, '[SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:1125)')))

value of the REQUESTS_CA_BUNDLE environment variable is picked up correctly by az login command (tested with dummy file link and it gives file not found error)

The rest of params:

PS C:\Users\xxxx> $env:SSL_CERT_FILE
C:\Users\xxxx\cacert-with-corp-proxy-cert.pem
PS C:\Users\xxxx> $REQUESTS_CA_BUNDLE
C:\Users\xxxx\cacert-with-corp-proxy-cert.pem

PS C:\Users\xxxx> az version
{
"azure-cli": "2.29.0",
"azure-cli-core": "2.29.0",
"azure-cli-telemetry": "1.0.6",
"extensions": {}
}

PS C:\Users\xxxx> $env:HTTP_PROXY
http://gate-xxx.xxxxxx.com:8080
PS C:\Users\xxxx> $env:HTTPS_PROXY
http://gate-xxx.xxxxxx.com:9443

Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,448 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,506 Reputation points
    2021-12-27T18:28:45.557+00:00

    Due to the authentication schematics of Azure Service, Azure CLI needs to pass an authentication payload through the HTTPS request, which will be denied at authentication time at your corporate proxy. By executing Azure login you will receive a TIMEOUT message- this is expected.

    This can be easily solved by setting HTTPS_PROXY environment variable.Note that changing the environment variables requires a reboot of your terminal to take effect.

    You can also refer to this article using Azure CLI effectively
    https://learn.microsoft.com/en-us/cli/azure/use-cli-effectively

    Hope this resolves your Query!!

    ------

    --If the reply is helpful, please Upvote and Accept it as an answer--