<p>Has anyone succeeded in getting kubectl connecting to the AKS public API endpoint for their AKS cluster, from behind  a corporate proxy that does SSL inspection ?</p>

<p>When I try to do something like</p>

<p><code>kubectl get nodes</code></p>

<p>I get the following error: (edited) </p>

<p><code>Unable to connect to the server: x509: certificate signed by unknown authority</code></p>

<p>So it appears my corporate proxy does SSL inspection.</p>

<p>My question would be: Is it at all possible to access the AKS public API via HTTPS through an SSL-interfering proxy, either via another "helper proxy" or other method?</p>

Traiano Welcome
<p>If your corporate proxy performs TLS re-encryption and injects its own certificate into TLS connection there are a couple of things you can do:</p>

<p>1) Extract your corporate TLS certificate and paste that in your ~/.kube/config. For that you'll need to get corporate certificate using for example this command </p>

<p><code>openssl s_client -showcerts -connect KUBE_API:443</code> </p>

<p>2) Skip TLS certificate verification in ~/.kube/config</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    server: https://KUBE_API:8443
    insecure-skip-tls-verify: true
</code></pre>
