cli-microsoft365: Bug report: Error adding spo site

@jacobsian-del the error you mention Error: unable to get local issuer certificate is different from the error you mention further down Error: Cannot convert undefined or null to object. Could you please run the command with the --debug option and share with us the full output (excluding the access token of course)? Thank you, and we appreciate your help to understand what’s going on.

Is the tenant that you’re running this command against an old dev tenant, instant sandbox or a regular tenant?

It’s (what I assume is) a regular tenant created on my M365 developer subscription.

Also, does it have targeted release enabled?

Not to my knowledge, kept it to the default options on creation. Where would I go to check?

I hope you don’t mind all these questions as we’re trying to understand what could be wrong exactly.

Not at all, thanks for putting up with me for something I strongly suspect is going to end up being a personal problem 😃

Some preliminary findingings, but I’m on another network at another localtion today so this should make sure I have everything covered. WIll post findings later today

Also, does it have targeted release enabled?

Not to my knowledge, kept it to the default options on creation. Where would I go to check?

@jacobsian-del you can check it at https://admin.microsoft.com/Adminportal/Home#/featureexplorer/:/Settings/L1/ReleasePreferences

Yep Standard Release.

I’ve tested from the Terminal and VS Code.

The error Error: unable to get local issuer certificate is what i get when I run the command without the --debug option. When I run with the --debug option I get the Error: Cannot convert undefined or null to object message.

Running: m365 spo site add --alias team1 --title "Team 1" Result: Error: unable to get local issuer certificate

Running: m365 spo site add --alias team1 --title "Team 1" --debug Result:

Executing command spo site add with options {"options":{"alias":"team1","title":"Team 1","debug":true}}
No SPO URL available. Retrieving from MS Graph...
Existing access token {BearerToken} still valid. Returning...
Request:
{
  "headers": {
    "common": {
      "Accept": "application/json, text/plain, */*"
    },
    "delete": {},
    "get": {},
    "head": {},
    "post": {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    "put": {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    "patch": {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    "user-agent": "NONISV|SharePointPnP|CLIMicrosoft365/5.1.0",
    "accept-encoding": "gzip, deflate",
    "accept": "application/json;odata.metadata=none",
    "authorization": "{BearerToken}"
  },
  "decompress": true,
  "responseType": "json",
  "url": "https://graph.microsoft.com/v1.0/sites/root?$select=webUrl",
  "method": "get"
}
Request error:
Error: Cannot convert undefined or null to object

Sorry I’ve been on vacation.

Testing the command after running m365 cli reconsent resulted in the same message as originally reported.

@jacobsian-del are you working behind a corporate proxy?

@garrytrinder While I’m not currently on the VPN, It’s very possible something running is intercepting traffic, but I would have expected all commands making graph requests to fail no? This is first command I’ve run into this with.

@jacobsian-del are you working behind a corporate proxy?

I have seen this issue before when using Azure CLI, which is caused by the proxy intercepting the CLI’s HTTPS traffic, decrypting and re-encrypting it with its own certificate.

We do have an open issue related to Axios, which we use to execute requests from the CLI, not supporting custom certificate CAs, I think these maybe related 👉 https://github.com/pnp/cli-microsoft365/issues/2155

@appieschot that is sooo cool 🤩 @jacobsian-del may I kindly ask you to check this 👍

@Adam-it we have a m365 reconsent command that allows you to make sure all permissions are in place (https://pnp.github.io/cli-microsoft365/cmd/cli/cli-reconsent/) might be a quicker way.

I checked the functionality in the latest CLI version and seems to be working ok. Seems like the problem might be connected to some local settings 🤔. If the request using graph explorer works fine (and basically CLI uses the same) lets also ensure we are using the same account for the check. May I ask you to restart from scratch and do the following steps:

• logout from m365 with m365 logout command
• go to AAD to Enterprise applications section and remove the 'PnP Management Shell` app
• login to m365 with m365 login command and be sure to approve all needed permissions
• recheck 🙂

yep comes back as expected:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#sites(webUrl)/$entity",
    "webUrl": "https://jacobsian.sharepoint.com"
}