Sign in Get started

Forward Deployed Engineering Tutorial · Deploying in Customer Environments · Lesson 16 of 24

Networks, Proxies and Firewalls

Make software work behind corporate proxies, TLS inspection, egress allow-lists and private connectivity.

Create a free account to save this page, take notes and track your progress. Sign in

What you'll meet inside enterprises

  • Outbound proxies: traffic to the internet must go through HTTPS_PROXY.
  • TLS inspection: the proxy re-signs HTTPS traffic with the company's own CA; clients must trust that CA, or every call fails with certificate errors.
  • Egress allow-lists: only approved domains or IPs are reachable; you must provide yours (and keep them stable).
  • Private connectivity: PrivateLink, VPN or peering instead of the public internet.
Proxies, TLS inspection and allow-listsTry it yourself
ALLOW_LIST = {"api.vendor.example", "auth.vendor.example"}
TRUSTED_CAS = {"PublicRootCA"}

def call(host, presented_ca, extra_cas=()):
    if host not in ALLOW_LIST:
        return f"{host}: blocked by egress allow-list"
    if presented_ca not in TRUSTED_CAS | set(extra_cas):
        return f"{host}: certificate verify failed (issuer {presented_ca})"
    return f"{host}: ok"

print(call("api.vendor.example", "CorpProxyCA"))                       # TLS inspection
print(call("api.vendor.example", "CorpProxyCA", extra_cas=["CorpProxyCA"]))  # configure the CA bundle
print(call("telemetry.vendor.example", "PublicRootCA"))                # not on the allow-list

Output

api.vendor.example: certificate verify failed (issuer CorpProxyCA)
api.vendor.example: ok
telemetry.vendor.example: blocked by egress allow-list

Making clients configurable

Support standard proxy variables (HTTPS_PROXY, NO_PROXY), a configurable CA bundle (REQUESTS_CA_BUNDLE, NODE_EXTRA_CA_CERTS, Java truststores), and list every domain and port your software needs in the install guide. Never "fix" certificate errors by disabling verification.

See the Networking tutorial for DNS, TLS and cloud networking basics.

Test yourself

Inside a customer network every HTTPS call fails with 'certificate verify failed'. Most likely cause?

  1. A TLS-inspecting proxy whose CA your client doesn't trust
  2. The API is down
  3. Wrong OAuth scope
  4. DNS TTL too long
Show answer

Answer: A TLS-inspecting proxy whose CA your client doesn't trust

Configure the customer's CA bundle; never disable verification.

Was this page helpful?