azcli issues when behind a corporate firewall

I am trying to use AZCLI from vscode behind a corporte firewall and receiving this message:

cli.azure.cli.core.azclierror: HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max retries exceeded with url: /organizations/v2.0/.well-known/openid-configuration (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain (_ssl.c:997)')))

> az_command_data_logger:
> HTTPSConnectionPool(host='login.microsoftonline.com', port=443): Max
> retries exceeded with url:
> /organizations/v2.0/.well-known/openid-configuration (Caused by
> SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED]
> certificate verify failed: self signed certificate in certificate
> chain (_ssl.c:997)')))
>
> Certificate verification failed. This typically happens when using
> Azure CLI behind a proxy that intercepts traffic with a self-signed
> certificate. Please add this certificate to the trusted CA bundle.
> More info:
> https://docs.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy.

cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x0402A460>]

the problem is that I have no clue which certificate is the one that I should at in vscode bundle.

I added some root certs found in my certificates mmc in the file found at:

C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem

yet, I am not able to run azcli from vscode. any ideas on how could I find the firewall certs??

So far, also tried to set variables:

setx AZURE_CLI_DISABLE_CONNECTION_VERIFICATION 1

setx ADAL_PYTHON_SSL_NO_VERIFY 1

added a lot of root certs that my computer has but I have no clue if there are any others that I need to add there.

other thing that Idk what means is something I saw in many threads about REQUEST_CA_BUNDLE. should it help?

From the error message it is pretty clear that the issue is due to the SSL certificate verification.

Plan 1:
Firstly, Inorder to find the root certificate that you need to follow the below article:
https://github.com/jiasli/azure-notes/blob/master/cli/proxy-cert-linux.md

After you get the root certification information, you need to follow the below article:
https://docs.microsoft.com/cli/azure/use-cli-effectively#work-behind-a-proxy

Plan 2:
If the above doesn't help, try appending standard Python root CAs to your pem file and check if that helps to run the CLI command.

> REQUESTS_CA_BUNDLE=$HOME/certs/internal.pem

Plan 3:
Try disabling SSL certificate verification temporarily by setting the REQUESTS_CA_BUNDLE environment variable to None and check if that helps to run the CLI command.

> export REQUESTS_CA_BUNDLE=None

Plan 4:
Run this command and check the result:

> python.exe" -c "import urllib.request; print(urllib.request.getproxies())"

This should give you the proxy details. You can then reach out to your internal Corporate proxy team and check if they can provide you the cerificate which you can use in the above steps and then append that certificate to this file C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\certifi\cacert.pem.

Hope this helps.