az cli - ssl - "Basic Constraints of CA cert not marked critical"

[henrypost]

Describe the bug

Hey all. In our corporate environment, we MiTM our traffic using a network monitoring tool. We get this below error when using az login, and we have already set the related SSL cert environment variables.

This error below makes me feel like our cert that we're trusting is missing some sort of field. Is there any way we can fix this, or override the validation and still trust our cert?

"""HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1032)')))"""

Related command

az login

Errors

"""HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1032)')))"""

Issue script & Debug output

"""HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Basic Constraints of CA cert not marked critical (_ssl.c:1032)')))"""

Expected behavior

az login works.

Environment Summary

azure-cli 2.83.0

core 2.83.0
telemetry 1.1.0

Dependencies:
msal 1.35.0b1
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\User.azure'
Extensions directory 'C:\Users\User.azure\cliextensions'

Python (Windows) 3.13.11 (tags/v3.13.11:6278944, Dec 5 2025, 16:26:58) [MSC v.1944 64 bit (AMD64)]

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• AZ Login fails with SSL intercept for 2.77.0 #32206
• az login --tennat <tenant-ID> failing because of SSLCertVerification #24597
• azure cli proxy connection issue from windows  #21696
• MSAL authentication doesn't respect REQUESTS_CA_BUNDLE for proxy certificates #32207
• 2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032) #32083

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

The solution is to update your proxy's certificate to make it strict mode compliant. E.g., for the mitmproxy, since its v10.1.2 release, it has fixed this issue in PR: mitmproxy/mitmproxy#6410. Based on this, this is a user-side issue caused by Python 3.13, rather than an Azure CLI issue.

Reference:

• AZ Login fails with SSL intercept for 2.77.0 #32206 (comment)

Solution 2:

Using a valid certificate with Authority Key Identifier is the only way to fix this issue. Python 3.13 now requires stricter SSL controls, and the AKI property is now required within the certificate. The certificate being used must comply with these stricter requirements.

Reference:

• 2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032) #32083 (comment)
• 2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032) #32083 (comment)
• 2.77.0 raises error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: Missing Authority Key Identifier (_ssl.c:1032) #32083 (comment)

Solution 3:

Follow the official documentation to add your self-signed certificate to the CA bundle. Refer to https://docs.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy for detailed steps.

Reference:

• az login --tennat <tenant-ID> failing because of SSLCertVerification #24597 (comment)
• azure cli proxy connection issue from windows  #21696 (comment)

Powered by issue-sentinel