登录到 Azure 容器注册表时，SSL 证书验证失败

Question

我是 Azure 的新手，正在尝试从我的计算机(mac OS(获取命令行。我通过自制软件安装了 azure-cli，当我执行 az login 时，出现以下错误：

Error occurred in request., SSLError: HTTPSConnectionPool(host='management.azure.com', port=443): Max retries exceeded with url: /tenants?api-version=2016-06-01 (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",),))
Traceback (most recent call last):
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/urllib3/contrib/pyopenssl.py", line 441, in wrap_socket
    cnx.do_handshake()
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/OpenSSL/SSL.py", line 1806, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/OpenSSL/SSL.py", line 1546, in _raise_ssl_error
    _raise_current_error()
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]

我尝试了以下方法：

export ADAL_PYTHON_SSL_NO_VERIFY=1
export AZURE_CLI_DISABLE_CONNECTION_VERIFICATION=1

根据这个： https://github.com/Azure/azure-cli/issues/2267

这让我可以登录，但是当我执行az acr login --name <registry name>时，我再次收到类似的错误：

HTTPSConnectionPool(host='registryName.azurecr.io', port=443): Max retries exceeded with url: /v2/ (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')],)",),))
Traceback (most recent call last):
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/urllib3/contrib/pyopenssl.py", line 441, in wrap_socket
    cnx.do_handshake()
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/OpenSSL/SSL.py", line 1806, in do_handshake
    self._raise_ssl_error(self._ssl, result)
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/OpenSSL/SSL.py", line 1546, in _raise_ssl_error
    _raise_current_error()
  File "/usr/local/Cellar/azure-cli/2.0.25/libexec/lib/python3.6/site-packages/OpenSSL/_util.py", line 54, in exception_from_error_queue
    raise exception_type(errors)
OpenSSL.SSL.Error: [('SSL routines', 'ssl3_get_server_certificate', 'certificate verify failed')]

我能做些什么来解决这个问题吗？提前谢谢。

Answer 1

尝试设置REQUESTS_CA_BUNDLE，如此处文档中所述：https://github.com/Azure/azure-cli/blob/dev/doc/use_cli_effectively.md#working-behind-a-proxy

Answer 2

我认为问题是 Python 库没有正确执行握手。 从错误来看，OpenSSL似乎不想在Python脚本发出请求时信任该请求。

https://pyopenssl.org/en/stable/api.html 此站点提供有关 OpenSSL 库的信息。 Python 脚本似乎没有正确实现 SSL 函数。