2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032)

[tamaw]

Describe the bug

After trying to log back in with az login az cli is receiving a certificate problem. With Context it is known the company uses its own CA/IA issued, which has been correctly set and been working previously. The error has been noticed today.

Previously the CA/IA have been imported into a ca bundle and referenced by environment variable REQUEST_CA_BUNDLE which has been working fine.

With the more recent version. 2.77.0 appears to be ignoring the set environment variable. Not confirmed. Requests have been receiving the error CERTIFICATE_VERIFY_FAILED Missing Authority Key Identifier.

Debugging

• The bundle has been checked against any new certificates the org may have issued.
• The environment variable is correctly set and seen when printing and via gci

Workaround:
Probably not the best idea but setting $env:AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1 works.

Related command

az login

Errors

CERTIFICATE_VERIFY_FAILED
Missing Authority Key Identifier

Issue script & Debug output

Expected behavior

Login to work correctly.

Environment Summary

Environment:

• Windows 10/11 affected
• Powershell
• az cli 2.77.0 as above

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921
• AZ login is failing with CERTIFICATE_VERIFY_FAILED #23886
• unable to login to AZ  #13032

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Install pip-system-certs to make Azure CLI use the Windows system certificates. Run the following command in PowerShell:

"C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

If you have the new 64-bit installer, use:

"C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe" -m pip install pip-system-certs

This will install a hook that tells certifi, and thus requests, to use the Windows system certificates.

Reference:

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)

Solution 2:

Ensure the REQUESTS_CA_BUNDLE environment variable is correctly set to point to your CA bundle. For example:

$Env:REQUESTS_CA_BUNDLE = "C:\path\to\your\ca-bundle.pem"

Make sure the CA bundle includes all necessary certificates, and verify that the certificate chain is complete.

Reference:

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)

Solution 3:

Manually add your organization's custom CA certificate to the cacert.pem file used by Azure CLI. Locate the cacert.pem file in the Azure CLI installation directory (e.g., C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\) and append your CA certificate to it. This ensures that Azure CLI recognizes your custom CA.

Reference:

• az login fails with CERTIFICATE_VERIFY_FAILED and I am not behind a proxy #20921 (comment)
• unable to login to AZ  #13032 (comment)

Powered by issue-sentinel

[jiasli]

I am not able to reproduce this issue.

I tested with the latest Azure CLI 2.77.0 ZIP package:

> az -v
azure-cli                         2.77.0

core                              2.77.0
telemetry                          1.1.0

Extensions:
account                            0.2.5
ad                                 0.1.0
ssh                                2.0.6

Dependencies:
msal                            1.34.0b1
azure-mgmt-resource               23.3.0

Python location 'D:\tools\azure-cli\python.exe'
Config directory 'C:\Users\xxx\.azure'
Extensions directory 'C:\Users\xxx\.azure\cliextensions'

Python (Windows) 3.13.7 (tags/v3.13.7:bcee1c3, Aug 14 2025, 14:15:11) [MSC v.1944 64 bit (AMD64)]

Launch mitmproxy and use it as the HTTPS_PROXY. Azure CLI fails as expected:

> $env:HTTPS_PROXY='http://127.0.0.1:8080'
> az login
HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1032)')))
Certificate verification failed. This typically happens when using Azure CLI behind a proxy that intercepts traffic with a self-signed certificate. Please add this certificate to the trusted CA bundle. More info: https://learn.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

After setting REQUESTS_CA_BUNDLE to mitmproxy's CA, Azure CLI works as expected:

> $env:REQUESTS_CA_BUNDLE='C:\Users\xxx\.mitmproxy\mitmproxy-ca-cert.pem'
> az login
Select the account you want to log in with. For more information on login with Azure CLI, see https://go.microsoft.com/fwlink/?linkid=2271136

Retrieving tenants and subscriptions for the selection...

Please double check if the CA is set correctly.

[jiasli]

You may also try directly using Python to isolate the problem:

python -c "import requests; print(requests.get('https://login.microsoftonline.com/').status_code)"