Skip to content

MSAL authentication doesn't respect REQUESTS_CA_BUNDLE for proxy certificates #32207

Open
Open
MSAL authentication doesn't respect REQUESTS_CA_BUNDLE for proxy certificates#32207
Assignees
jiasli
Labels
Accountaz login/accountAuto-AssignAuto assign by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamComputeaz vm/vmss/image/disk/snapshotPossible-SolutionSimilar-Issueact-identity-squadact-observability-squadcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
Milestone
Backlog

Description

@ciaran-finnegan
Ciaran Finnegan (ciaran-finnegan)
opened on Oct 1, 2025

Describe the bug

MSAL authentication in Azure CLI doesn't respect the REQUESTS_CA_BUNDLE environment variable when
working behind a proxy with custom certificates. While other Azure CLI operations properly use custom CA
bundles specified via REQUESTS_CA_BUNDLE, the MSAL library used for authentication (particularly az login) ignores this setting, causing SSL certificate verification errors even when users have correctly
configured their proxy certificates according to the official documentation.

Related command

az login
az login --debug

Errors

Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate.

SSL: CERTIFICATE_VERIFY_FAILED

Issue script & Debug output

Environment setup

export HTTPS_PROXY=https://corporate-proxy:8080
export REQUESTS_CA_BUNDLE=/path/to/custom-ca-bundle.pem

Run login with debug

az login --debug

Debug output shows NO indication of using custom cert bundle for MSAL:

DEBUG: Getting management service client client_type=SubscriptionClient
DEBUG: urllib3.connectionpool: Starting new HTTPS connection
ERROR: SSL: CERTIFICATE_VERIFY_FAILED

Expected debug output (missing):

DEBUG: MSAL: Using CA bundle file at '/path/to/custom-ca-bundle.pem'

Other az commands work fine with the same REQUESTS_CA_BUNDLE:

az vm list --debug

Shows: DEBUG: Using CA bundle file at '/path/to/custom-ca-bundle.pem'

Expected behavior

When REQUESTS_CA_BUNDLE environment variable is set:

  1. MSAL authentication should use the specified custom CA bundle file
  2. az login --debug should show debug message indicating the custom CA bundle is being used
  3. Authentication should succeed without SSL certificate verification errors
  4. Behavior should be consistent with other Azure CLI operations that already respect this environment
    variable

This is documented behavior according to:
https://learn.microsoft.com/en-us/cli/azure/use-azure-cli-successfully-troubleshooting#work-behind-a-pro
xy

Environment Summary

azure-cli 2.77.0

core 2.77.0
telemetry 1.1.0

Dependencies:
msal 1.34.0b1
azure-mgmt-resource 23.3.0

Python location '/opt/homebrew/Cellar/azure-cli/2.77.0/libexec/bin/python'
Config directory '/Users/ciaranfinnegan/.azure'
Extensions directory '/Users/ciaranfinnegan/.azure/cliextensions'

Python (Darwin) 3.13.7 (main, Aug 14 2025, 11:12:11) [Clang 17.0.0 (clang-1700.0.13.3)]

Additional context

No response

Activity

  1. Ciaran Finnegan (ciaran-finnegan)
    added
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Oct 1, 2025
  2. microsoft-github-policy-service
    added
    customer-reportedIssues that are reported by GitHub users external to the Azure organization.
    Computeaz vm/vmss/image/disk/snapshot
    on Oct 1, 2025
  3. microsoft-github-policy-service
    assigned
    Julie Zhu (yanzhudd)
    and
    Xing Zhou (zhoxing-ms)
    on Oct 1, 2025
  4. microsoft-github-policy-service
    added
    Auto-AssignAuto assign by bot
    Azure CLI TeamThe command of the issue is owned by Azure CLI team
    questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that
    Accountaz login/account
    on Oct 1, 2025
  5. microsoft-github-policy-service
    assigned
    Jiashuo Li (jiasli)
    on Oct 1, 2025

  6. yonzhan commented on Oct 1, 2025

    @yonzhan
    Yong Zhang (yonzhan)
    on Oct 1, 2025
    Collaborator

    Thank you for opening this issue, we will look into it.

  7. github-actions
    added
    Possible-Solution
    Similar-Issue
    on Oct 1, 2025

  8. github-actions commented on Oct 1, 2025

    @github-actions
    github-actionsbot
    on Oct 1, 2025 – with GitHub Actions

    Here are some similar issues that might help you. Please check if they can solve your problem.

    Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

    Solution 1:

    Downgrade Azure CLI to version 2.76.0, which does not exhibit this issue. Use the following script to downgrade:

    - task: CmdLine@2
  displayName: "Downgrade Azure CLI to 2.76.0"
  inputs:
    script: |
      # Obtain the currently installed distribution
      AZ_DIST=$(lsb_release -cs)

      # Store an Azure CLI version of choice
      AZ_VER=2.76.0

      # Install a specific version
      sudo apt-get install --allow-downgrades -y azure-cli=${AZ_VER}-1~${AZ_DIST}

    Reference:

    Solution 2:

    Ensure that the certificate being used includes the Authority Key Identifier (AKI) property. This is required due to stricter SSL controls introduced in Python 3.13, which Azure CLI 2.77.0 uses. Certificates without the AKI property will fail verification.

    Reference:

    Solution 3:

    Set the environment variable AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 as a workaround to bypass SSL verification. Note that this is not recommended for production environments due to security risks.

    Reference:

    Powered by issue-sentinel

  9. Yong Zhang (yonzhan)
    added this to the Backlog milestone on Oct 1, 2025
  10. Yong Zhang (yonzhan)
    removed
    bugThis issue requires a change to an existing behavior in the product in order to be resolved.
    on Oct 1, 2025
  11. Yong Zhang (yonzhan)
    unassigned
    Xing Zhou (zhoxing-ms)
    and
    Julie Zhu (yanzhudd)
    on Oct 1, 2025

  12. brow86 commented on Oct 3, 2025

    @brow86
    Brett (brow86)
    on Oct 3, 2025

    We have encountered this as a byproduct of ZScaler. For az login the workaround was to set PYTHONVERIFY=0. There are other az commands that won't respect this, like az aks install. That would indicate the modules aren't using a consistent path for connecting.

  13. jiasli commented on Oct 14, 2025

    @jiasli
    Jiashuo Li (jiasli)
    on Oct 14, 2025
    Contributor

    It is by design that AZURE_CLI_DISABLE_CONNECTION_VERIFICATION is not honored when calling MSAL during authentication, as disabling SSL verification puts Azure CLI at risk. Setting the root CA with REQUESTS_CA_BUNDLE is the only supported approach.

    We haven't observed that MSAL doesn't respect REQUESTS_CA_BUNDLE. In my recent experiment #32083 (comment), MSAL does honor REQUESTS_CA_BUNDLE when connecting to login.microsoftonline.com.

  14. Aditya Pujara (a0x1ab)
    added
    act-identity-squad
    act-observability-squad
    on Apr 1, 2026
  15. Sid (sid-bruno)
    added a commit that references this issue on Aug 21, 2026

    feat: add `proxy` and `SSL certificate` support for `AWS, Azure, and …

    79284c8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Accountaz login/accountAuto-AssignAuto assign by botAzure CLI TeamThe command of the issue is owned by Azure CLI teamComputeaz vm/vmss/image/disk/snapshotPossible-SolutionSimilar-Issueact-identity-squadact-observability-squadcustomer-reportedIssues that are reported by GitHub users external to the Azure organization.questionThe issue doesn't require a change to the product in order to be resolved. Most issues start as that

Type

No type

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions