az aks install-cli: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate

[bavneetsingh16]

Describe the bug

Trying to use az connectedk8s cmd which internally uses az aks install-cli --install-location <path_to_kubectl.exe> to install kubectl.exe file. The cmd fails with the below error.

Related command

az aks install-cli --install-location <path_to_kubectl.exe> --debug

Errors

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)

Issue script & Debug output

cli.azure.cli.core.azclierror: The command failed with an unexpected error. Here is the traceback:
az_command_data_logger: The command failed with an unexpected error. Here is the traceback:
cli.azure.cli.core.azclierror: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)>
Traceback (most recent call last):
File "urllib\request.py", line 1348, in do_open
File "http\client.py", line 1298, in request
File "http\client.py", line 1344, in _send_request
File "http\client.py", line 1293, in endheaders
File "http\client.py", line 1052, in _send_output
File "http\client.py", line 990, in send
File "http\client.py", line 1470, in connect
File "ssl.py", line 517, in wrap_socket
File "ssl.py", line 1104, in _create
File "ssl.py", line 1382, in do_handshake
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)

Expected behavior

It should be able to download the kubectl file.

Environment Summary

azure-cli 2.63.0 *

core 2.63.0 *
telemetry 1.1.0

Additional context

No response

[azure-client-tools-bot-prd]

Hi @bavneetsingh16,

2.63.0 is not the latest Azure CLI(2.64.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az aks install-cli errpr #13915
• SSL: CERTIFICATE_VERIFY_FAILED #13910
• az aks install-cli fails #16955
• Issue while installing AKS cli - certificate verify failed: unable to get local issuer certificate #11554
• unable to run az aks install-cli #12870

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @dyu1208, @FumingZhang, @andyliuliming.

[jagadishmurugan]

the issue repro's on Azure VM with following specs:
Standard D8s v3 (8 vcpus , 32 GiB memory)
Security Type: Standard

[jagadishmurugan]

the following workaround helped resolve the issue;

1. install python
2. pip install pip-system-certs

[mbifeld]

@bavneetsingh16 I believe this issue can be closed based on #30561 being merged. Please let me know if this remains an active issue.