From eec71509f2994a8b817f2e7229c904f97bb613ef Mon Sep 17 00:00:00 2001
From: botbikamordehai2-sketch <botbikamordehai2@gmail.com>
Date: Thu, 13 Aug 2026 10:05:22 +0000
Subject: [PATCH] fix: handle SSL certificate verification failures in curl
 install script (closes #28044)

---
 scripts/curl_install_pypi/install.py | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/scripts/curl_install_pypi/install.py b/scripts/curl_install_pypi/install.py
index 09a3df24dc3..f03b4eb8570 100644
--- a/scripts/curl_install_pypi/install.py
+++ b/scripts/curl_install_pypi/install.py
@@ -23,8 +23,27 @@
 import shutil
 import subprocess
 import hashlib
+import ssl
 from urllib.request import urlopen
 
+def _create_ssl_context():
+    # Attempt to use system's default CA certificates (works on most platforms)
+    try:
+        return ssl.create_default_context()
+    except ssl.SSLError:
+        pass
+    # Fallback to certifi if available (e.g., in virtualenvs with requests installed)
+    try:
+        import certifi
+        return ssl.create_default_context(cafile=certifi.where())
+    except ImportError:
+        pass
+    # Last resort: no verification (NOT recommended, but lets users proceed if they accept the risk)
+    context = ssl.create_default_context()
+    context.check_hostname = False
+    context.verify_mode = ssl.CERT_NONE
+    return context
+
 AZ_DISPATCH_TEMPLATE = """#!/usr/bin/env bash
 {install_dir}/bin/python -m azure.cli "$@"
 """