SSL Certificate Verification Error with Azure AI Inference Endpoint on macOS

[ChimeraFlutter]

Environment

• OS: macOS Darwin 24.5.0
• Python: 3.13 (both system and venv)
• AutoGen Version: autogen-agentchat, autogen-ext[azure]
• Related Packages:
  • aiohttp==3.12.15
  • azure-core
  • azure-ai-inference

Error Message

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1028)

azure.core.exceptions.ServiceRequestError: Cannot connect to host models.inference.ai.azure.com:443 ssl:True [SSLCertVerificationError: (1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1028)')]

Code to Reproduce

from autogen_ext.models.azure import AzureAIChatCompletionClient
from azure.core.credentials import AzureKeyCredential

client = AzureAIChatCompletionClient(
    model="gpt-4o-mini",
    endpoint="https://models.inference.ai.azure.com",
    credential=AzureKeyCredential(os.getenv("GITHUB_TOKEN")),
    model_info={
        "json_output": True,
        "function_calling": True,
        "vision": True,
        "family": "unknown",
        "structured_output": True,
    },
)

What I've Tried

1. Installed and activated truststore:

   pip install truststore
   import truststore
   truststore.inject_into_ssl()

2. Set environment variables:

   export PYTHONHTTPSVERIFY=0
   export SSL_CERT_FILE=""
   export REQUESTS_CA_BUNDLE=""

3. Updated certifi:

   pip install --upgrade certifi

4. Ran Python's Install Certificates.command for macOS

5. Used proxy (http://127.0.0.1:7890/) - proxy works but SSL error persists

6. Tried monkey patching ssl and aiohttp - no effect

Additional Information

• The same URL (https://models.inference.ai.azure.com) works fine in browsers

• curl with -k flag works successfully

• The issue appears to be specific to the Azure SDK's internal HTTP client

• When trying to patch aiohttp's SSL context, I get the following error:

  verify_ssl, ssl_context, fingerprint, and ssl parameters are mutually exclusive
  

Expected Behavior

The AutoGen client should successfully connect to Azure AI Inference endpoint without SSL certificate errors.

Questions

1. Is there a way to disable SSL verification in AzureAIChatCompletionClient?
2. Are there any known issues with macOS + Python 3.13 + Azure SDK SSL handling?
3. Is there a recommended workaround for development environments?

Any help would be greatly appreciated. This is blocking the use of AutoGen with GitHub Models on macOS.

[github-actions]

👋 Thanks for contributing @ChimeraFlutter! We will review the issue and get back to you soon.