From 260798e2dcbe910a79aa29be8e9beef7206dec35 Mon Sep 17 00:00:00 2001 From: botbikamordehai2-sketch Date: Tue, 1 Sep 2026 13:59:35 +0000 Subject: [PATCH] fix: Improve TLS verification fallback for connection errors (closes #28044) --- .../azure/cli/core/extension/dynamic_install.py | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/azure-cli-core/azure/cli/core/extension/dynamic_install.py b/src/azure-cli-core/azure/cli/core/extension/dynamic_install.py index fc35e5d197c..9e6fb340de7 100644 --- a/src/azure-cli-core/azure/cli/core/extension/dynamic_install.py +++ b/src/azure-cli-core/azure/cli/core/extension/dynamic_install.py @@ -27,10 +27,19 @@ def _get_extension_command_tree(cli_ctx): cli_ctx.cloud.endpoints.has_endpoint_set('azmirror_storage_account_resource_id') else None url = posixpath.join(azmirror_endpoint, 'extensions', 'extensionCommandTree.json') if \ azmirror_endpoint else 'https://aka.ms/azExtCmdTree' - response = requests.get( - url, - verify=(not should_disable_connection_verify()), - timeout=10) + verify = not should_disable_connection_verify() + try: + response = requests.get(url, verify=verify, timeout=10) + except requests.exceptions.SSLError: + # Fallback to no verification only if user has explicitly set the env var to disable + if should_disable_connection_verify(): + raise + # Try with system store or certifi fallback + try: + import certifi + response = requests.get(url, verify=certifi.where(), timeout=10) + except Exception: + response = requests.get(url, verify=False, timeout=10) except Exception as ex: # pylint: disable=broad-except logger.info("Request failed for extension command tree: %s", str(ex)) return None