How to fix fatal: unable to access: Proxy auto-configuration failed in Git

GitINTERMEDIATEMEDIUM

This error occurs when Git attempts to use a Proxy Auto-Configuration (PAC) file but fails because Git does not natively support PAC files. In corporate environments where network traffic is routed through proxies configured via PAC scripts, Git operations like clone, push, and pull will fail until you manually extract and configure the proxy settings.

What this error means

The "Proxy auto-configuration failed" error indicates that Git is trying to use a PAC (Proxy Auto-Configuration) file to determine which proxy server to use, but Git's HTTP library (libcurl) cannot process the PAC file format. PAC files are JavaScript-based configuration files that tell applications which proxy server to use for different URLs. Web browsers can interpret these scripts, but Git cannot. When your system or environment is configured to use a PAC file (often set via WPAD or system proxy settings), Git fails because it doesn't have a JavaScript interpreter to execute the PAC script logic. This is an extremely common issue in corporate and enterprise environments where: - **Network administrators** use PAC files to dynamically route traffic through different proxies based on destination - **Security appliances** inspect outbound traffic and require specific proxy routes - **VPN configurations** automatically set system proxy settings to PAC file URLs - **Group Policy** on Windows machines enforces PAC-based proxy configuration The fundamental problem is that Git expects a direct proxy URL (like `http://proxy.company.com:8080`), not a PAC file URL (like `http://wpad.company.com/proxy.pac`).

How to fix "fatal: unable to access: Proxy auto-configuration failed"

1Extract the actual proxy server from the PAC file

Since Git cannot interpret PAC files, you need to extract the actual proxy server URL from the PAC file contents.

Step 1: Download and view your PAC file

If you know your PAC file URL (check your system proxy settings):

bash

# Download the PAC file
curl -o proxy.pac http://wpad.company.com/proxy.pac

# View the contents
cat proxy.pac

Step 2: Find the proxy server in the PAC file

PAC files are JavaScript that typically contain return statements with proxy information:

javascript

// Example PAC file content
function FindProxyForURL(url, host) {
    if (isPlainHostName(host))
        return "DIRECT";
    if (dnsDomainIs(host, ".internal.company.com"))
        return "DIRECT";
    return "PROXY proxy.company.com:8080; DIRECT";
}

Look for lines like:
- return "PROXY proxy.company.com:8080"
- return "PROXY 10.0.0.1:3128"

The format is PROXY hostname:port. Extract this value for the next step.

On Windows, you can also find your proxy via registry:

cmd

reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer

2Configure Git with the extracted proxy server

Once you have the proxy server hostname and port, configure Git to use it directly:

bash

# Set HTTP proxy globally
git config --global http.proxy http://proxy.company.com:8080

# Set HTTPS proxy (uses same setting)
git config --global https.proxy http://proxy.company.com:8080

If your proxy requires authentication:

bash

# With username and password (password will be stored in plain text in .gitconfig)
git config --global http.proxy http://username:[email protected]:8080

Verify the configuration:

bash

git config --global --get http.proxy
git config --global --get https.proxy

Test the connection:

bash

git ls-remote https://github.com/git/git.git

3Use environment variables for proxy configuration

Instead of Git config, you can use environment variables which are recognized by Git and many other tools:

Linux/macOS:

bash

# Set for current session
export http_proxy=http://proxy.company.com:8080
export https_proxy=http://proxy.company.com:8080
export HTTP_PROXY=http://proxy.company.com:8080
export HTTPS_PROXY=http://proxy.company.com:8080

# Make permanent by adding to ~/.bashrc or ~/.zshrc
echo 'export http_proxy=http://proxy.company.com:8080' >> ~/.bashrc
echo 'export https_proxy=http://proxy.company.com:8080' >> ~/.bashrc

Windows Command Prompt:

cmd

set http_proxy=http://proxy.company.com:8080
set https_proxy=http://proxy.company.com:8080

Windows PowerShell:

powershell

$env:http_proxy = "http://proxy.company.com:8080"
$env:https_proxy = "http://proxy.company.com:8080"

# Make permanent
[System.Environment]::SetEnvironmentVariable("http_proxy", "http://proxy.company.com:8080", "User")
[System.Environment]::SetEnvironmentVariable("https_proxy", "http://proxy.company.com:8080", "User")

With authentication:

bash

export http_proxy=http://username:[email protected]:8080

4Configure proxy bypass for internal hosts

If you need to access both external repositories (via proxy) and internal Git servers (without proxy), configure exceptions:

bash

# Bypass proxy for specific domains
git config --global http.https://internal.company.com.proxy ""

# Set no_proxy environment variable
export no_proxy=localhost,127.0.0.1,.internal.company.com,.local

# On Windows
set no_proxy=localhost,127.0.0.1,.internal.company.com

In .gitconfig, you can set per-URL proxy settings:

ini

[http]
    proxy = http://proxy.company.com:8080
[http "https://internal.company.com"]
    proxy = ""
[http "https://gitlab.internal.com"]
    proxy = ""

This configuration uses the proxy for external sites but bypasses it for internal URLs.

5Use a local proxy tool that interprets PAC files

If you need dynamic proxy selection that PAC files provide, use a local proxy tool that can interpret PAC files and expose a simple HTTP proxy for Git:

px (Proxy PAC executor) - Recommended for Windows:

bash

# Install px
pip install px-proxy

# Run px with your PAC file
px --pac=http://wpad.company.com/proxy.pac

# px starts a local proxy on 127.0.0.1:3128
# Configure Git to use it
git config --global http.proxy http://127.0.0.1:3128

CNTLM (for NTLM authentication):
CNTLM is useful when your corporate proxy requires NTLM/Windows authentication:

bash

# Install CNTLM
# Ubuntu/Debian
sudo apt install cntlm

# Configure /etc/cntlm.conf with your credentials and upstream proxy
# Then start CNTLM
sudo systemctl start cntlm

# Configure Git to use CNTLM's local proxy
git config --global http.proxy http://127.0.0.1:3128

proxy-pac-proxy (Node.js based):

bash

npm install -g proxy-pac-proxy
proxy-pac-proxy -p 8888 -P http://wpad.company.com/proxy.pac

# Configure Git
git config --global http.proxy http://127.0.0.1:8888

6Clear any system-level proxy settings affecting Git

Git may be inheriting proxy settings from your system. Clear these to use your explicit Git configuration:

Check current Git proxy settings:

bash

# List all proxy-related config
git config --list | grep -i proxy

# Check environment variables
env | grep -i proxy

Clear Git proxy settings:

bash

# Remove global proxy settings
git config --global --unset http.proxy
git config --global --unset https.proxy

# Remove system-level settings (if set)
git config --system --unset http.proxy
git config --system --unset https.proxy

Clear environment variables:

bash

# Linux/macOS
unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY

# Windows Command Prompt
set http_proxy=
set https_proxy=

On Windows, check for proxy in registry:

cmd

reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings"

After clearing, set the correct proxy using the extracted values from Step 1.

7Use SSH instead of HTTPS to bypass proxy issues

If proxy configuration continues to be problematic, consider using SSH for Git operations instead of HTTPS. SSH typically doesn't go through HTTP proxies:

Step 1: Generate SSH key (if you don't have one)

bash

ssh-keygen -t ed25519 -C "[email protected]"

Step 2: Add SSH key to your Git provider
- Copy the public key: cat ~/.ssh/id_ed25519.pub
- Add it to GitHub/GitLab/Bitbucket in your account settings

Step 3: Change remote URL to SSH

bash

# Check current remote
git remote -v

# Change from HTTPS to SSH
git remote set-url origin [email protected]:username/repo.git

# For GitLab
git remote set-url origin [email protected]:username/repo.git

If SSH is also blocked, configure SSH over HTTPS port (for GitHub):

bash

# Edit ~/.ssh/config
Host github.com
    Hostname ssh.github.com
    Port 443
    User git

This routes SSH traffic over port 443, which is typically allowed through corporate firewalls.

Advanced notes

Understanding PAC file format:
PAC files contain a JavaScript function FindProxyForURL(url, host) that returns one of:
- "DIRECT" - Connect directly without proxy
- "PROXY host:port" - Use the specified HTTP proxy
- "SOCKS host:port" - Use the specified SOCKS proxy
- Multiple entries separated by semicolons for fallback

Common PAC file helper functions:
- isPlainHostName(host) - Returns true if hostname has no dots
- dnsDomainIs(host, domain) - Checks if host is in domain
- isInNet(host, pattern, mask) - Checks if host IP matches pattern
- shExpMatch(str, pattern) - Shell expression pattern matching

Debugging proxy issues:

bash

# Verbose Git output showing HTTP/proxy details
GIT_CURL_VERBOSE=1 git clone https://github.com/user/repo.git

# Test proxy connectivity with curl
curl -v --proxy http://proxy.company.com:8080 https://github.com

# Check if proxy requires authentication
curl -v --proxy http://proxy.company.com:8080 --proxy-user user:pass https://github.com

WPAD (Web Proxy Auto-Discovery):
Many corporate networks use WPAD, which automatically discovers the PAC file location via:
1. DHCP option 252
2. DNS lookup for wpad.yourdomain.com
3. URL http://wpad.yourdomain.com/wpad.dat

If your network uses WPAD, you can often find the PAC file at these URLs.

Git proxy settings precedence:
1. GIT_PROXY_COMMAND environment variable (custom proxy command)
2. http.<url>.proxy config for specific URLs
3. http.proxy config (global)
4. HTTP_PROXY / HTTPS_PROXY environment variables
5. System proxy settings (varies by OS)

For SOCKS proxy support:

bash

# SOCKS5 proxy
git config --global http.proxy socks5://127.0.0.1:1080

# SOCKS5 with hostname resolution via proxy
git config --global http.proxy socks5h://127.0.0.1:1080

Handling 407 Proxy Authentication Required:
If you get a 407 error after configuring the proxy:

bash

# Include credentials in proxy URL
git config --global http.proxy http://username:[email protected]:8080

# Or use a credential helper for more secure storage
git config --global credential.helper store

CI/CD Pipeline considerations:
In CI/CD environments, set proxy via environment variables in your pipeline configuration:

yaml

# GitLab CI example
variables:
  http_proxy: "http://proxy.company.com:8080"
  https_proxy: "http://proxy.company.com:8080"
  no_proxy: "localhost,127.0.0.1,.internal.company.com"

How to fix fatal: unable to access: Proxy auto-configuration failed in Git

What this error means

Typical symptoms

Common causes

How to fix "fatal: unable to access: Proxy auto-configuration failed"

Advanced notes

Related errors

Official resources & further reading