title: SSL handshake error with some Azure CLI commands
body: <p>I am using Azure CLI in bash within PowerShell in Windows 10. I sit behind a corporate proxy. My goal is to automate the deployment and setup of Azure resources.</p>
  
  <p>Some of the Azure CLI commands work perfectly fine: I can run az login, change the default subscription, list locations, resource groups, resources within resource groups and I can even run shell scripts to deploy resources like Key Vaults. </p>
  
  <p>However, when I try to list the keys or secrets within a Key Vault, or create keys/secrets I get the following:</p>
  
  <p><strong>Error occurred in request., SSLError: HTTPSConnectionPool(host='xxxxxx.vault.azure.net', port=443): Max retries exceeded with url: /secrets?api-version=7.0 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))</strong></p>
  
  <p>The example I am providing here is for a Key Vault, but I am getting the same error with other types of resources, so I don't think the Key Vault is the issue. </p>
  
  <p>When appending the <code>--debug</code> parameter to the command, I can see the error is coming from one of the Python libraries:</p>
  
  <p><strong>urllib3.connectionpool : Retrying (Retry(total=0, connect=4, read=4, redirect=None, status=None)) after connection broken by 'SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),)': /secrets?api-version=7.0</strong></p>
  
  <p>I have tried the suggestions provided at:</p>
  
  <p><a href="https://blog.jhnr.ch/2018/05/16/working-with-azure-cli-behind-ssl-intercepting-proxy-server/" rel="noreferrer">Working with Azure CLI behind SSL intercepting proxy server</a>,</p>
  
  <p>Including <code>export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=anycontent</code> to disable certificate check (not recommended) and <code>export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt</code> to make Python requests use the system ca-certificates bundle.</p>
  
  <p>I have also tried:</p>
  
  <p><code>export ADAL_PYTHON_SSL_NO_VERIFY=1</code></p>
  
  <p>which is suggested in the following post:</p>
  
  <p><a href="https://github.com/Azure/azure-cli/issues/2267" rel="noreferrer">[AzureStack] Handle SSL verification for certs not in Python root CA list #2267</a></p>
  
  <p>But unfortunately none of the above produced any change in the outcome.</p>
  
  <p>I am using Azure CLI version 2.0.60 and Python 3.</p>