az containerapp exec fails with SSL error on public ACA environments

[achandmsft]

Problem

az containerapp exec fails with an SSL handshake error even on non-VNet (public) ACA environments:

ssl.SSLEOFError: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred in violation of protocol (_ssl.c:1032)

The same operation works via the Azure Portal Console, suggesting it's a CLI-specific issue.

Reproduction

1. Deploy a container app to a public ACA environment (no VNet)
2. Run:

   az containerapp exec --name <app> --resource-group <rg> --command /bin/bash

3. SSL error occurs

Workaround

Use Azure Portal > Container App > Console > /bin/bash instead.

Expected behavior

az containerapp exec should work on public ACA environments. The SSL websocket connection should succeed when the container is running.

Environment

• Azure CLI 2.x (latest)
• ACA public environment (no VNet, external ingress)
• Container in Running state
• Windows client

[yonzhan]

Thank you for opening this issue, we will look into it.