Surface SSL/TLS certificate errors clearly when SSL inspection proxies intercept connections

[Copilot]

When running behind SSL inspection proxies (Zscaler, Cisco Umbrella, etc.), connections fail silently with generic gRPC timeouts or networking errors, giving no indication that certificate validation is the root cause. Users waste time debugging what is ultimately a trust-store issue.

Changes

SSL detection helpers (ColoredConsoleLogger)

• ContainsSslKeywords(string) — matches known SSL failure phrases: CERTIFICATE_VERIFY_FAILED, certificate signed by unknown authority, The remote certificate is invalid, The SSL connection could not be established, SSL handshake failed, certificate verify failed
• IsSslCertificateException(Exception) — walks the full exception chain for AuthenticationException or any exception whose message matches the above keywords
• LogToConsoleWithSslHint(...) — unified helper called from Log() that emits the original message then, if SSL is detected, appends two Warning-level lines:
  • SslCertificateErrorDetected — what happened
  • SslCertificateHint — how to fix it (add proxy root cert to system trust store)

PublishFunctionAppAction — HttpRequestException catch now checks IsSslCertificateException first; SSL-caused failures get the targeted message instead of the generic networking error.

ExtensionBundleHelper.GetExtensionBundle — new catch block for SSL exceptions fires before the generic network-failure handler; logs error + hint and falls back to cached bundle.

Constants.Errors — two new constants: SslCertificateErrorDetected and SslCertificateHint.

Tests

ColoredConsoleLoggerTests extended with:

• ContainsSslKeywords_Tests (11 inline cases, positive + negative)
• IsSslCertificateException_* (5 fact tests: direct AuthenticationException, nested, keyword-in-message, unrelated, null)

Pull request checklist

• My changes do not require documentation changes
  • Otherwise: Documentation issue linked to PR
• My changes do not need to be backported to a previous version
  • Otherwise: Backport tracked by issue/PR #issue_or_pr
• My changes should not be added to the release notes for the next release
  • Otherwise: I've added my notes to release_notes.md
• I have added all required tests (Unit tests, E2E tests)

Additional information

SSL errors originating in worker processes (Python, Node) appear as gRPC timeouts in the host — the host never sees an AuthenticationException. The detection in ColoredConsoleLogger covers the .NET-side surface (HTTP calls made by Core Tools itself, extension bundle downloads, publish). Worker-side SSL failures surfaced via log message text (e.g. CERTIFICATE_VERIFY_FAILED from Python's ssl module) are also caught via ContainsSslKeywords.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• azfunc.pkgs.visualstudio.com
  • Triggering command: /usr/bin/dotnet dotnet build src/Cli/func/Azure.Functions.Cli.csproj /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/Core/BaseUserSecretsTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/Core/BaseOfflineBundleTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/Core/BaseLogLevelTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/Core/BaseMissingConfigTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/ConsoleEncodingTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/AuthTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Fun�� /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/UserSecretsTests.cs /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/InProcTests/LogLevelTests.cs -l cert\|Cert re-functions-corhelp,version,id,description,release,codename,all,short (dns block)
  • Triggering command: /usr/bin/dotnet dotnet build src/Cli/func/Azure.Functions.Cli.csproj /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/test/Cli/Func.E2ETests/Commands/FuncStart/InProcTests/LogLevelTests.cs -l cert\|Cert re-functions-core-tools/src/Cli/func/Helpers/PlatformHelper.cs rep cert\|Cert ActionHelper.cs de/node/bin/grep grep -l cert\|Cert re-functions-core-tools/src/Cli/func/Helpers/SetupProgressLogger.cs nfig/composer/vendor/bin/grep cert\|Cert xception.cs rep grep (dns block)
  • Triggering command: /usr/bin/dotnet dotnet build test/Cli/Func.UnitTests/Azure.Functions.Cli.UnitTests.csproj conntrack --ctstate INVALID,NEW -j DROP cert\|Cert s tnet/tools/grep grep -l cert\|Cert re-functions-cor-d /home/REDACTED/wor168.63.129.16 cert\|Cert sions.cs ep grep (dns block)
• st8vsblobprodcus339.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet restore --no-dependencies /home/REDACTED/work/azure-functions-core-tools/azure-functions-core-tools/Azure.Functions.Cli.sln --packages /tmp/codeql-scratch-50c7d6e9ded3e5a4/dbs/csharp/working/packages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal /p:TargetFrameworkRootPath=/tmp/codeql-scratch-50c7d6e9ded3e5a4/dbs/csharp/working/emptyFakeDotnetRoot /p:NetCoreTargetingPackRoot=/tmp/codeql-scratch-50c7d6e9ded3e5a4/dbs/csharp/working/emptyFakeDotnetRoot /p:AllowMissingPrunePackageData=true -l cert\|Cert s-core-tools/azure-functions-cor/home/REDACTED/work/azure-functions-core-tools/azure-functions-corshow /home/REDACTED/work/_temp/ghcca-no/home/REDACTED/work/azure-functions-core-tools/azure-functions-cor9ee53cf3cd394c97d2740e1343fff59bf1b26d0a:test/Cli/Func.UnitTests/ConsoleTests/ColoredConsoleLoggerTests.cs cert\|Cert .cs ep grep (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)