Azure CLI not able to install bicep extension

[dirthsj]

Describe the bug

I am unable to install the bicep module

Related command

az bicep install --debug

Errors

cli.azure.cli.core.azclierror: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))).
az_command_data_logger: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))).

Issue script & Debug output

cli.knack.cli: Command arguments: ['bicep', 'install', '--debug']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x0158E938>, <function OutputProducer.on_global_arguments at 0x01AD7A28>, <function CLIQuery.on_global_arguments at 0x01AF87F8>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'bicep': ['azure.cli.command_modules.resource']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name                  Load Time    Groups  Commands
cli.azure.cli.core: resource                  0.523        51       231
cli.azure.cli.core: Total (1)                 0.523        51       231
cli.azure.cli.core: Loaded 51 groups, 231 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command  : bicep install
cli.azure.cli.core: Command table: bicep install
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x03BE5E88>]
cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to 'C:\Users\-redacted-\.azure\commands\2024-07-25.13-31-01.bicep_install.33924.log'.
az_command_data_logger: command args: bicep install --debug
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x03BF8AC8>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x03C30168>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x03C30208>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x01AD7A78>, <function CLIQuery.handle_query_parameter at 0x01AF8848>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x03C301B8>]
urllib3.connectionpool: Starting new HTTPS connection (1): aka.ms:443
cli.azure.cli.core.azclierror: Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 715, in urlopen
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 404, in _make_request
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 1060, in _validate_conn
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connection.py", line 419, in connect
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/ssl_.py", line 449, in ssl_wrap_socket
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/ssl_.py", line 493, in _ssl_wrap_socket_impl
  File "ssl.py", line 517, in wrap_socket
  File "ssl.py", line 1104, in _create
  File "ssl.py", line 1382, in do_handshake
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/adapters.py", line 564, in send
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/connectionpool.py", line 801, in urlopen
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\urllib3/util/retry.py", line 594, in increment
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/_bicep.py", line 200, in get_bicep_latest_release_tag
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/api.py", line 73, in get
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/api.py", line 59, in request
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/sessions.py", line 589, in request
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/sessions.py", line 703, in send
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\requests/adapters.py", line 595, in send
requests.exceptions.SSLError: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)')))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 664, in execute
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 731, in _run_jobs_serially
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 701, in _run_job
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 334, in __call__
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/custom.py", line 4646, in install_bicep_cli
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/_bicep.py", line 129, in ensure_bicep_installation
  File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/resource/_bicep.py", line 204, in get_bicep_latest_release_tag
azure.cli.core.azclierror.ClientRequestError: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))).

cli.azure.cli.core.azclierror: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))).
az_command_data_logger: Error while attempting to retrieve the latest Bicep version: HTTPSConnectionPool(host='aka.ms', port=443): Max retries exceeded with url: /BicepLatestRelease (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1006)'))).
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x03BE9028>]
az_command_data_logger: exit code: 1
cli.__main__: Command ran in 1.846 seconds (init: 0.834, invoke: 1.012)
telemetry.main: Begin splitting cli events and extra events, total events: 1
telemetry.client: Accumulated 0 events. Flush the clients.
telemetry.main: Finish splitting cli events and extra events, cli events: 1
telemetry.save: Save telemetry record of length 3814 in cache
telemetry.main: Begin creating telemetry upload process.
telemetry.process: Creating upload process: "C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry\__init__.pyc C:\Users\-redacted-\.azure"
telemetry.process: Return from creating process
telemetry.main: Finish creating telemetry upload process.

Expected behavior

bicep module installs successfully

Environment Summary

azure-cli                         2.62.0

core                              2.62.0
telemetry                          1.1.0

Dependencies:
msal                              1.28.1
azure-mgmt-resource               23.1.1

Python location 'C:\Program Files (x86)\Microsoft SDKs\Azure\CLI2\python.exe'
Extensions directory 'C:\Users\-snip-\.azure\cliextensions'

Python (Windows) 3.11.8 (tags/v3.11.8:db85d51, Feb  6 2024, 21:52:07) [MSC v.1937 32 bit (Intel)]

Legal docs and information: aka.ms/AzureCliLegal


Unable to check if your CLI is up-to-date. Check your internet connection.

Additional context

My machine has a ZScaler proxy on it, however, I have a temporary exemption from IT and confirmed certificates for aka.ms are not proxied using powershell

$URL = 'https://aka.ms/'
$Connection = [System.Net.HttpWebRequest]::Create($URL)
$Response = $Connection.GetResponse()
$Response.Dispose()
$Certificate = $Connection.ServicePoint.Certificate

Write-Output $Certificate

Result:

       Handle Issuer                                                                  Subject                                                                            
       ------ ------                                                                  -------                                                                            
2376361149168 CN=Microsoft Azure RSA TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=redirectiontool.trafficmanager.net, O=Microsoft Corporation, L=Redmond, S=WA,...

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• SSL: CERTIFICATE_VERIFY_FAILED error on "az bicep install" Resurfaced #20842
• SSL: CERTIFICATE_VERIFY_FAILED error on "az bicep install"  #19420
• Error while attempting to retrieve the latest Bicep version:  #22194
• az bicep install fails #28044
• SSL: CERTIFICATE_VERIFY_FAILED error on "az bicep install" Resurfaced Again . Reference #20842 #27096

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/deployments-owners.

[anthony-c-martin]

@dirthsj The https://aka.ms/BicepLatestRelease link redirects to https://downloads.bicep.azure.com/releases/latest. Based on the logs you shared, it seems like the issue with aka.ms and not downloads.bicep.azure.com.

Just to rule out an issue with the AzureCLI logging, would you mind running the same powershell test for the https://downloads.bicep.azure.com/releases/latest link?

Some other stuff that would be interesting to also test on your machine - which I think would allow us to isolate this to python/azure cli:

• Curl/wget for the above two URLs - does this fail?
• Opening the above URLs in a browser

[dirthsj]

Repeating the powershell test for that link gives me a slightly different result, but the certificate still looks good to me.

       Handle Issuer                                                                  Subject                                                                     
       ------ ------                                                                  -------                                                                     
1897946292688 CN=Microsoft Azure RSA TLS Issuing CA 03, O=Microsoft Corporation, C=US CN=downloads.bicep.azure.com, O=Microsoft Corporation, L=Redmond, S=WA, C=US

Running curl https://downloads.bicep.azure.com/releases/latest works, outputting the contents of the release file into the terminal. Running curl -L https://aka.ms/BicepLatestRelease does the same.

Both links work when opened in Microsoft edge, downloading the release file.

[jsolarz]

For anyone with the same issue, here's a possible solution. This worked for me: python/cpython#108721

[torreymicrosoft]

Thanks for your patience — this was recently picked up as an outstanding open issue for the ARM Deployments team to review.

As @anthony-c-martin noted back in July 2024, the failure is at the TLS layer reaching aka.ms / downloads.bicep.azure.com, and your own tests (curl + Edge succeeding) point at the Python runtime bundled with Azure CLI rather than the Bicep download itself. As @jsolarz linked (python/cpython#108721), this is the familiar pattern where a TLS-inspecting proxy (e.g. ZScaler) re-signs the connection with a corporate root CA that the CLI's bundled certificate store doesn't trust — so curl/Edge (Windows cert store) succeed while the CLI's Python (its own certifi bundle) fails with CERTIFICATE_VERIFY_FAILED.

Two things that usually unblock it:

1. Point the CLI at a CA bundle that includes your corporate root/intermediate CA:

   $env:REQUESTS_CA_BUNDLE = "C:\path\to\corp-ca-bundle.pem"
   

   (PEM containing the ZScaler root + intermediates). This is the documented approach for running Azure CLI behind a TLS-inspecting proxy.

2. If you'd rather skip the download path entirely, install Bicep yourself and tell the CLI to use it:

   az config set bicep.use_binary_from_path=true
   

   with bicep on PATH.

Could you try option 1 and let us know if it clears the az bicep install failure? As this should work - I'm going to close this out for now, since it's a certificate-trust/proxy configuration rather than a CLI defect — happy to reopen if it persists.

(For reference, the underlying "Bicep commands fail during the version check" behaviour is also tracked upstream in Azure/bicep#18368.)