How to fix Error: error configuring HTTP client in Terraform

First, verify whether your network uses a proxy. Test direct connectivity to the endpoint Terraform is trying to reach:

# Try to reach the provider or API endpoint directly
curl -v https://registry.terraform.io
curl -v https://app.terraform.io

# If the connection hangs or times out, you likely need a proxy

If you are behind a proxy, configure the environment variables before running Terraform:

export HTTP_PROXY=http://proxy.example.com:8080
export HTTPS_PROXY=http://proxy.example.com:8080
export NO_PROXY=localhost,127.0.0.1

This tells Terraform to route HTTP and HTTPS traffic through the proxy server.

If your organization uses custom Certificate Authority (CA) certificates (common in corporate environments), you need to make them available to Terraform:

On Linux:

export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt

On macOS:

export SSL_CERT_FILE=/usr/local/etc/openssl/cert.pem

On Windows (PowerShell):

$env:SSL_CERT_FILE='C:\path\to\ca-bundle.crt'

For Terraform Enterprise with a private CA, create a CA bundle file by concatenating the Terraform Enterprise certificate with intermediate certificates:

cat terraform-cert.pem intermediate-cert.pem > ca-bundle.pem
export SSL_CERT_FILE=/path/to/ca-bundle.pem

Set Terraform's logging to debug level to see detailed information about the HTTP client initialization:

export TF_LOG=DEBUG
terraform plan 2>&1 | tee terraform-debug.log

Search the log for HTTP client configuration errors, certificate validation failures, or proxy-related messages. These details will tell you exactly what is misconfigured.

Common debug messages include:
- "certificate signed by unknown authority" - Your CA cert is not trusted
- "proxy error" or "connect: connection refused" - Proxy is unreachable
- "invalid header field value" - Token or credential format is wrong

If the error persists after proxy and certificate fixes, the issue may be authentication:

# For Terraform Cloud/Enterprise login
terraform login

# For AWS provider credentials
aws configure

# Verify credentials are set
printenv | grep -E 'TERRAFORM|AWS|API'

Ensure:
- API tokens are valid and not expired
- Credentials are in the correct format (especially for Windows PowerShell)
- The terraform login command completes successfully and writes to ~/.terraform.rc

Check your Terraform provider configuration for syntax errors or missing required fields:

provider "aws" {
  region = "us-east-1"
  # Ensure region is set correctly

  # For self-signed certificates only (not recommended for production)
  skip_credentials_validation = false
  skip_requesting_account_id  = false
}

For providers with custom HTTP settings (like the HTTP backend), verify mTLS configuration if used:

terraform {
  backend "http" {
    address        = "https://state.example.com/state"
    lock_address   = "https://state.example.com/lock"
    unlock_address = "https://state.example.com/unlock"

    # Include CA certificate for self-signed servers
    skip_cert_verification = false
  }
}

Out-of-date Terraform or provider versions may have HTTP client bugs. Update to the latest versions:

# Check your current version
terraform version

# Upgrade Terraform (installation method depends on your OS)
# On macOS with Homebrew:
brew upgrade terraform

# On Linux, download from https://www.terraform.io/downloads
# Then update your .terraform.lock.hcl to use the latest provider versions:

terraform init -upgrade

Newer versions often include fixes for SSL/TLS and HTTP client issues. After upgrading, try the Terraform command again.