Microsoft.AI.Foundry.Local.Common.FLException: The SSL connection could not be established, see inner exception

[bmerkle]

I successfully installed foundry, however when downloading models it fails with a SSL exception.

We have a Zscaler proxy in place in our company so I added the Zscaler root and intermediate certificate to the windows cert store via certlm.msc
Local Machine → Trusted Root Certification Authorities
Local Machine → Intermediate Certification Authorities

I also have ollama running (in parallel) and downloading models there works (I have set also the following env)
REQUESTS_CA_BUNDLE=C:\Users\merklbe1\certificates\cacert.pem
SSL_CERT_FILE=C:\Users\merklbe1\certificates\cacert.pem
HTTP_PROXY and HTTPS_PROXY are also set.

Can you please advise if i should check additional settings or communication ways.
curl works ok and also foundry model list

I append the console output and have also create a service diag file which i attach

thanks for your help

[foundry.20251124.003417.zip](https://github.com/user-attachments/files/23699624/foundry.20251124.003417.zip)

[bmerkle]

here is my console output

PS C:\Users\merklbe1> certlm.msc
PS C:\Users\merklbe1> foundry service stop
🔴 Service is stopped.
PS C:\Users\merklbe1> foundry service start
🟢 Service is Started on http://127.0.0.1:65125/, PID 37980!
PS C:\Users\merklbe1> foundry model download phi-4-mini --verbose
Downloading Phi-4-mini-instruct-cuda-gpu:5...
[00:28:25 ERR] Failed to download model Phi-4-mini-instruct-cuda-gpu:5, error The SSL connection could not be established, see inner exception.
Failed: Downloading Phi-4-mini-instruct-cuda-gpu:5
Exception: The SSL connection could not be established, see inner exception.
[00:28:25 ERR] LogException
Microsoft.AI.Foundry.Local.Common.FLException: The SSL connection could not be established, see inner exception.
   at Microsoft.AI.Foundry.Local.Common.ModelManagement.<DownloadModelAsync>d__9.MoveNext() + 0x2304
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.Common.ModelManagement.<DownloadModelAsync>d__9.MoveNext() + 0x25e5
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.Commands.ModelDownloadCommand.<<Create>b__1_0>d.MoveNext() + 0x137
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.Common.CommandActionFactory.<>c__DisplayClass0_0`1.<<Create>b__0>d.MoveNext() + 0x1e7
--- End of stack trace from previous location ---
   at System.CommandLine.NamingConventionBinder.CommandHandler.<GetExitCodeAsync>d__66.MoveNext() + 0x50
--- End of stack trace from previous location ---
   at System.CommandLine.NamingConventionBinder.ModelBindingCommandHandler.<InvokeAsync>d__11.MoveNext() + 0x61
--- End of stack trace from previous location ---
   at System.CommandLine.Invocation.InvocationPipeline.<InvokeAsync>d__0.MoveNext() + 0x1cd
--- End of stack trace from previous location ---
   at Microsoft.AI.Foundry.Local.Program.<Main>d__1.MoveNext() + 0x4e4
PS C:\Users\merklbe1> certlm.msc
PS C:\Users\merklbe1> foundry service diag --logs
Logs files added to 'C:\Users\merklbe1\OneDrive - SICK AG\Desktop\foundry.20251124.003417.zip'
===================================================

Press any key to continue...
PS C:\Users\merklbe1> foundry model list | select-string phi-3

phi-3.5-mini                   GPU        chat-completion    2.13 GB      MIT          Phi-3.5-mini-instruct-cuda-gpu:1
                               GPU        chat-completion    1.95 GB      MIT          Phi-3.5-mini-instruct-openvino-gpu:1
                               GPU        chat-completion    2.13 GB      MIT          phi-3.5-mini-instruct-trtrtx-gpu:1
                               GPU        chat-completion    2.16 GB      MIT          Phi-3.5-mini-instruct-generic-gpu:1
                               CPU        chat-completion    2.53 GB      MIT          Phi-3.5-mini-instruct-generic-cpu:1
phi-3-mini-128k                GPU        chat-completion    2.13 GB      MIT          Phi-3-mini-128k-instruct-cuda-gpu:1
                               GPU        chat-completion    2.13 GB      MIT          phi-3-mini-128k-instruct-trtrtx-gpu:1
                               GPU        chat-completion    2.27 GB      MIT          Phi-3-mini-128k-instruct-openvino-gpu:1
                               GPU        chat-completion    2.13 GB      MIT          Phi-3-mini-128k-instruct-generic-gpu:1
                               CPU        chat-completion    2.54 GB      MIT          Phi-3-mini-128k-instruct-generic-cpu:2
phi-3-mini-4k                  GPU        chat-completion    2.13 GB      MIT          Phi-3-mini-4k-instruct-cuda-gpu:1
                               GPU        chat-completion    2.13 GB      MIT          phi-3-mini-4k-instruct-trtrtx-gpu:1
                               GPU        chat-completion    2.01 GB      MIT          Phi-3-mini-4k-instruct-openvino-gpu:1
                               GPU        chat-completion    2.13 GB      MIT          Phi-3-mini-4k-instruct-generic-gpu:1
                               CPU        chat-completion    2.53 GB      MIT          Phi-3-mini-4k-instruct-generic-cpu:2

PS C:\Users\merklbe1>

C:\Users\merklbe1>ollama pull phi4-mini:latest
pulling manifest
pulling 3c168af1dea0:   8% ▕█████                                                              ▏ 210 MB/2.5 GB  6.0 MB/s   6m21s

[bmerkle]

I am a bit puzzled here, can someone from the team comment if there is more logging/debug option ?

I tried a few test to be sure that my zscaler certificates are in place:

• imported them with certlm.msc
• run a minimal .NET application works also (program.cs attached, could not upload it)
• run curl with SSL works
  but it did not help

using System;
using System.Net.Http;
using System.Threading.Tasks;

class Program
{
    static async Task Main()
    {
        var handler = new HttpClientHandler
        {
            UseProxy = true,
            Proxy = System.Net.WebRequest.DefaultWebProxy
        };

        using var client = new HttpClient(handler);
        client.DefaultRequestHeaders.Add("User-Agent", "ssl-test");

        try
        {
            var resp = await client.GetAsync("https://www.microsoft.com");
            Console.WriteLine($"Status: {(int)resp.StatusCode} {resp.ReasonPhrase}");
        }
        catch (Exception ex)
        {
            Console.WriteLine("ERROR: " + ex);
        }
    }
}

[bmerkle]

Additionally GPT suggested to add a foundry specific configuration: (not sure if it hallucinated)

• Add the Zscaler CA to Foundry Local’s internal .NET trust store
• copy zscaler_root.cer "%USERPROFILE%.ai-foundry\local\runtime\certs"
• Force the runtime to trust custom certs inside %USERPROFILE%.ai-foundry\local\runtime\
• json file below
• restart foundry local environment (stop/start)

Note: i replaced .ai-foundry with .foundry of course, but it still does not work,

I searched for a possiblity to deactivate (temporarily) SSL for model download but found none.

{
  "runtimeOptions": {
    "configProperties": {
      "System.Net.Http.UseEmbeddedHttpClientHandler": false,
      "System.Net.Http.EnableSslCertificateTrust": true,
      "System.Net.Http.SslCertificateTrustStorePath": "certs"
    }
  }
}

[bmerkle]

foundry model download phi-4-mini

seems that eastus.api.azureml.ms is somehow blocked in my company environment.

Please: could you add a more descriptive error message if model download fails ? (e.g. output the destination URL)

[bmerkle]

#326 should fix the issue / improve tracability.
It was not a SSL problem but rather a blocked URL in our company content scanning infrastructure.
I think we can close this for now.