How to use the UiPathCLI behind a Proxy

News Knowledge Base
1

This KB article explains how to use UiPath CLI in Azure DevOps pipelines when your build agent is behind an SSL‑inspecting proxy. It covers proxy configuration, SSL inspection, and the fix for the "self‑signed certificate in certificate chain" error raised by Node‑based tasks (e.g. UiPath CLI). The guidance below assumes your agent is running on Windows.

Description

When a build agent runs behind a proxy that performs TLS inspection, the proxy presents its own certificate in place of the remote service’s certificate. This causes Node‑based tasks to fail with self‑signed certificate in the certificate chain, because the Node runtime bundled with Azure DevOps does not trust Windows’ certificate store. You must provide Node with your proxy’s CA certificate and ensure the agent can read it. Once the CA is trusted by Node, the NuGet task can download the UiPath CLI package successfully.

Correct Way to Set Proxy Variables

Define proxy settings at the job or agent environment level (not only in script steps) so all processes, including UiPath CLI, inherit them:

variables:

- group: 'UiPath CLI' # variable group containing feed keys or other secrets

- name: HTTP_PROXY

value: 'http://<proxy-host>:<port>'

- name: HTTPS_PROXY

value: 'http://<proxy-host>:<port>'

- name: PACKAGE_VERSION

value: '1.0.$(Build.BuildId)'

Avoid setting $env:HTTPS_PROXY or $env:http_proxy only within PowerShell steps – those values apply only to the current shell and are not inherited by the CLI process.

SSL Inspection: Trusting the Proxy’s CA

If your proxy intercepts HTTPS, its root certificate must be trusted by the agent machine for the TLS handshake to succeed. Install the proxy’s CA certificate in the Trusted Root Certification Authorities store of the agent (Computer Account). Without this, any HTTPS call (including UiPath CLI) will fail, even if proxy variables are correct.

However, Node does not read the Windows trust store. You must pass your CA certificate via the NODE_EXTRA_CA_CERTS environment variable.

Moving the certificate to an accessible location

The Azure DevOps agent service typically runs under the NETWORK SERVICE account. If Node reports Input/output error when loading the cert, move the PEM file to a path accessible to all users, such as C:\agent\certs\myCA.pem.

  1. Export the proxy’s CA in PEM format from a machine that trusts the proxy.
  2. Copy it to a directory readable by the agent, e.g. C:\agent\certs. Ensure the file ends with .pem and contains -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

Setting NODE_EXTRA_CA_CERTS

Once the certificate is in place, instruct Node to load it via NODE_EXTRA_CA_CERTS.

Add the certificate path as a variable in your YAML file (keeping the same list format used for other variables):

variables:

- group: 'UiPath CLI'

- name: HTTP_PROXY

value: 'http://<proxy-host>:<port>'

- name: HTTPS_PROXY

value: 'http://<proxy-host>:<port>'

- name: PACKAGE_VERSION

value: '1.0.$(Build.BuildId)'

- name: NODE_EXTRA_CA_CERTS

value: 'C:\agent\certs\myCA.pem'

This ensures Node tasks in that pipeline load your CA cert. You must still ensure the file is accessible to the agent process.

Expected Behavior

Scenario: Local CLI without proxy

Proxy Var Set: no

Proxy intercepting TLS: n/a

Proxy CA trusted by machine: n/a

Node receives CA via Node_Extra_CA_Certs: n/a

Result: direct outbound call, bypass proxy.

Scenario: Pipeline with proxy vars only

Proxy Var Set: yes

Proxy intercepting TLS: no

Proxy CA trusted by machine: n/a

Node receives CA via Node_Extra_CA_Certs: n/a

Result: routes via proxy

Scenario: Pipeline with SSL interception

Proxy Var Set: yes

Proxy intercepting TLS: yes

Proxy CA trusted by machine: yes

Node receives CA via Node_Extra_CA_Certs: yes (certificate loaded)

Result: routes via proxy

Scenario: Pipeline with SSL interception

Proxy Var Set: yes

Proxy intercepting TLS: yes

Proxy CA trusted by machine: yes

Node receives CA via Node_Extra_CA_Certs: no

Result: fails (self-signed-certificate)

Scenario: Pipeline with SSL interception

Proxy Var Set: yes

Proxy intercepting TLS: yes

Proxy CA trusted by machine: no

Node receives CA via Node_Extra_CA_Certs: yes

Result: Fails (TLS handshake error)