HTTPS_PROXY not working? Check your client

Short answers

Use this order: confirm the proxy in curl, check the application’s environment without printing credentials, then inspect the client’s own proxy settings.

Match the variable to the destination

HTTPS_PROXY selects a proxy for an https:// destination. The URL stored in it describes the connection to the proxy. That means this is a valid combination for an HTTP proxy:

export https_proxy='http://gw.portproof.org:7000'

The proxy then opens an HTTP CONNECT tunnel for the HTTPS request. Do not change the value to https:// unless that proxy endpoint supports TLS connections to the proxy itself. How HTTPS works through an HTTP proxy.

The example above sets the server only. Keep the password in your normal secret configuration; do not paste it into shell history or diagnostic output.

These settings belong to each client; exporting a variable does not configure every program on the machine. See the primary references for curl, Requests, Node.js and Playwright.

Run this inside the failing process environment. It reports whether values exist and whether upper- and lower-case spellings conflict, without printing either value:

import os

for lower in ("http_proxy", "https_proxy", "all_proxy", "no_proxy"):
    upper = lower.upper()
    low = os.environ.get(lower)
    high = os.environ.get(upper)
    print(f"{lower}: {'set' if low else 'unset or empty'}")
    print(f"{upper}: {'set' if high else 'unset or empty'}")
    if low is not None and high is not None and low != high:
        print(f"{lower}/{upper}: values differ")

A shell variable without export is another common cause: child processes do not inherit it. Restart a long-running worker after changing its launch environment.

Check NO_PROXY for a matching exclusion

NO_PROXY and no_proxy identify destinations that should connect directly. curl reads a comma-separated host list, and a matching exclusion applies even when you set --proxy explicitly. Review the list locally; the presence check above detects conflicting spellings without printing their values. curl’s exclusion rules.

Use hostnames or literal IP addresses rather than full URLs or paths. curl matches the name in the URL; a DNS lookup does not turn a hostname into an IP exclusion. Other clients can interpret these lists differently. curl --noproxy reference.

Keep exclusions required by your deployment, such as local services. For one diagnostic request, --noproxy '' overrides both environment spellings with an empty list. Compare the same small authorised HTTPS endpoint with the explicit curl check below; keep its hostname, proxy and credentials consistent. A change narrows the problem to an exclusion, but HTTP success alone does not prove the route. Read the CONNECT status too, then change only the entry responsible. curl --noproxy reference.

Set the client that actually opens the connection

For GNU Wget, use the explicit environment and configuration check before comparing it with curl.

For Go, check environment versus explicit transport settings. In Postman, inspect the desktop proxy settings used by the request.

Node.js fetch

Check node --version in the deployed process. Built-in fetch supports NODE_USE_ENV_PROXY=1 from Node.js 22.21.0 on the 22 release line, and from 24.0.0 on the 24 release line. For built-in http and https methods, the corresponding documented minimums are 22.21.0 and 24.5.0. Enable it before the process starts. Node.js environment proxy support.

# HTTPS_PROXY is supplied through your existing secret configuration.
NODE_USE_ENV_PROXY=1 node app.mjs

On an older runtime, or when the application supplies a dispatcher, use that client’s documented proxy configuration. The Node.js fetch setup guide provides the explicit Undici example. Replacing http.globalAgent does not configure fetch. Node.js agent behaviour.

Python Requests

Setting only session.proxies can leave room for environment settings to replace your choice. Requests documents passing proxies on the individual request when you need that choice to win. Requests proxy precedence.

session.trust_env = False disables use of environment configuration, but also affects environment certificate-bundle settings and default authentication. If your network requires a custom CA bundle, configure it explicitly and keep certificate verification enabled. Requests session implementation.

Use the complete Python Requests example for encoded credentials, timeouts and cleanup.

Playwright

Configure the browser or browser context, then test a page navigation from that context. A separate request made by the Node process does not prove the browser received the same proxy configuration. Use the Playwright setup guide; its server and authentication fields match the documented browser proxy options.

Put the settings inside the worker

A variable in your terminal is not evidence that it exists in a container, scheduled job or service. Run the presence check above where the failing application runs.

For an existing container image, pass variables by name from an already configured environment:

# worker-image is your application's existing image.
docker run --rm \
  --env HTTPS_PROXY \
  --env NO_PROXY \
  worker-image

This avoids placing the expanded password directly in the command text. Container environment variables remain visible to users with access to the container configuration, so use your deployment’s secret mechanism for production credentials. Build-time proxy settings, container runtime settings and Docker daemon settings are separate. Docker proxy configuration.

For a service manager or scheduler, update that service’s launch configuration through the deployment process, then restart the worker and check it again. A command that succeeds in an interactive shell has only tested that shell’s child process.

Compare an explicit curl check with the application

Copy the full proxy username from your connection builder, including its pool and session settings. Replace YOUR_FULL_PROXY_USERNAME below. Run this in an interactive POSIX terminal; curl asks for the password without placing it in the command itself.

curl --disable --silent --show-error \
  --proxy 'http://gw.portproof.org:7000' \
  --proxy-user 'YOUR_FULL_PROXY_USERNAME' \
  --noproxy '' \
  --connect-timeout 5 --max-time 15 \
  --output /dev/null \
  --write-out 'connect_status=%{http_connect} target_status=%{response_code}\n' \
  'https://example.com/'

The check makes one GET request, follows no redirects and does not enable retries. Use a small HTTPS endpoint you are allowed to test. TLS certificate verification stays enabled. For Windows PowerShell, use curl.exe and adapt the line continuations.

connect_status=200 with a destination status confirms this request established an HTTP proxy tunnel and received an HTTP response inside it. connect_status=000 means no CONNECT status was recorded; read the curl error before deciding why. CONNECT response reporting.

Now make the same check from inside your application. A different result narrows the investigation to that process’s configuration. An echo endpoint can help observe the address seen by a destination, but two equal IP results alone cannot prove whether a proxy was used; shared network paths can produce the same public address.

Follow the error to its next step

Once the client works, keep the smallest reproducible check with your deployment instructions. For Portproof connection settings, use proxy setup and API documentation; for choosing a traffic amount, use pricing.

What is not allowed

Use these diagnostics only for services you are permitted to access. Follow the acceptable-use policy.

Read next