az aks install-cli fails with "CERTIFICATE_VERIFY_FAILED" error

[bebound]

Describe the bug

az aks install-cli fails with "CERTIFICATE_VERIFY_FAILED" error

Ubuntu 18.04.2 (WSL)

I've tried without https_proxy set and while not connected to the corporate network.

Command Name
az aks install-cli

Errors:

The command failed with an unexpected error. Here is the traceback:
<urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)>
Traceback (most recent call last):
  File "/opt/az/lib/python3.10/urllib/request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "/opt/az/lib/python3.10/http/client.py", line 1282, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/opt/az/lib/python3.10/http/client.py", line 1328, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/opt/az/lib/python3.10/http/client.py", line 1277, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/opt/az/lib/python3.10/http/client.py", line 1037, in _send_output
    self.send(msg)
  File "/opt/az/lib/python3.10/http/client.py", line 975, in send
    self.connect()
  File "/opt/az/lib/python3.10/http/client.py", line 1454, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/opt/az/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/opt/az/lib/python3.10/ssl.py", line 1071, in _create
    self.do_handshake()
  File "/opt/az/lib/python3.10/ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/opt/az/lib/python3.10/site-packages/knack/cli.py", line 233, in invoke
    cmd_result = self.invocation.execute(args)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 663, in execute
    raise ex
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
    results.append(self._run_job(expanded_arg, cmd_copy))
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 697, in _run_job
    result = cmd_copy(params)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/__init__.py", line 333, in __call__
    return self.handler(*args, **kwargs)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/core/commands/command_operation.py", line 121, in handler
    return op(**command_args)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/command_modules/acs/custom.py", line 1433, in k8s_install_cli
    k8s_install_kubectl(cmd, client_version, install_location, base_src_url, arch=arch)
  File "/opt/az/lib/python3.10/site-packages/azure/cli/command_modules/acs/custom.py", line 1548, in k8s_install_kubectl
    version = urlopen(source_url + '/stable.txt', context=context).read()
  File "/opt/az/lib/python3.10/urllib/request.py", line 216, in urlopen
    return opener.open(url, data, timeout)
  File "/opt/az/lib/python3.10/urllib/request.py", line 519, in open
    response = self._open(req, data)
  File "/opt/az/lib/python3.10/urllib/request.py", line 536, in _open
    result = self._call_chain(self.handle_open, protocol, protocol +
  File "/opt/az/lib/python3.10/urllib/request.py", line 496, in _call_chain
    result = func(*args)
  File "/opt/az/lib/python3.10/urllib/request.py", line 1391, in https_open
    return self.do_open(http.client.HTTPSConnection, req,
  File "/opt/az/lib/python3.10/urllib/request.py", line 1351, in do_open
    raise URLError(err)
urllib.error.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:997)>

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az aks install-cli

Expected Behavior

cli is installed.

Environment Summary

Linux-4.4.0-19041-Microsoft-x86_64-with-glibc2.27, Ubuntu 18.04.2 LTS
Python 3.10.8
Installer: DEB

azure-cli 2.45.0

Extensions:
interactive 0.4.6
managementpartner 0.1.3

Dependencies:
msal 1.20.0
azure-mgmt-resource 21.1.0b1

Additional Context

Copy from https://github.com/Azure/azure-cli/issues/25470

[similar-bot-test]

Find similar issue https://github.com/Azure/azure-cli/issues/11555.

Issue title	AKS cli install - SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:841)
Create time	2019-12-11
Comment number	4