I am using Azure CLI in bash within PowerShell in Windows 10. I sit behind a corporate proxy. My goal is to automate the deployment and setup of Azure resources.
Some of the Azure CLI commands work perfectly fine: I can run az login, change the default subscription, list locations, resource groups, resources within resource groups and I can even run shell scripts to deploy resources like Key Vaults.
However, when I try to list the keys or secrets within a Key Vault, or create keys/secrets I get the following:
Error occurred in request., SSLError: HTTPSConnectionPool(host='xxxxxx.vault.azure.net', port=443): Max retries exceeded with url: /secrets?api-version=7.0 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))
The example I am providing here is for a Key Vault, but I am getting the same error with other types of resources, so I don't think the Key Vault is the issue.
When appending the --debug
parameter to the command, I can see the error is coming from one of the Python libraries:
urllib3.connectionpool : Retrying (Retry(total=0, connect=4, read=4, redirect=None, status=None)) after connection broken by 'SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),)': /secrets?api-version=7.0
I have tried the suggestions provided at:
Working with Azure CLI behind SSL intercepting proxy server,
Including export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=anycontent
to disable certificate check (not recommended) and export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
to make Python requests use the system ca-certificates bundle.
I have also tried:
export ADAL_PYTHON_SSL_NO_VERIFY=1
which is suggested in the following post:
[AzureStack] Handle SSL verification for certs not in Python root CA list #2267
But unfortunately none of the above produced any change in the outcome.
I am using Azure CLI version 2.0.60 and Python 3.