Blog
Corporate Proxy Failures in a CLI
Office networks break CLIs with proxies, custom CAs, and blocked domains. The error has to say whether DNS, TLS, or the proxy refused you. Developers on a laptop at home will never reproduce it.
2026-07-30 · 7 min read · AethelLayer
Home Wi-Fi is not their network
A quickstart that worked on your laptop fails on a company proxy. The developer cannot paste a clean curl from home and match it. They need the CLI to name the failure on the network where it happened.
Honor HTTPS_PROXY, HTTP_PROXY, and NO_PROXY. Document that you do. A tool that ignores the variables every other CLI respects looks broken.
Split TLS, DNS, and proxy auth
A custom corporate CA causes certificate verify failed. A blocked domain causes a timeout or a reset. A proxy that wants credentials causes 407. Those three codes need three messages.
The TLS message should say which host you verified and that a company CA may need to be in the trust store. Do not tell them to disable verification.
Your APM will not see this
If the connection never left their building, your tracing backend has no span. The probe has to be sent from the CLI, or stored locally until a network exists.
Send the error code, the host, and whether a proxy environment variable was set. Do not send the proxy URL if it contains a password.
Write the workaround into the error
If the supported fix is a flag for a CA bundle, print the flag. If you cannot support their proxy, say that in the error so they stop retrying.
Drafts that all mention the same host and certificate error are a docs page, not a backlog of individual bugs.
Keep reading
Capture the failure before they leave
Capture the failure before they leave. Book early access or talk to sales, then install @aethellayer/sdk when you are onboarded.