---
title: Usage with a proxy server
slug: mbmd0426
canonical_url: https://docs.coveo.com/en/mbmd0426/
collection: cli
source_format: adoc
---
# Usage with a proxy server
If you install, update, or use the Coveo CLI on a computer that's behind a company firewall or web proxy, you may receive an error message similar to the following (error messages differ between operating systems):

```bash
coveo-cli: Updating CLI... !
 ▸  'ECONNRESET': tunneling socket could not be established, cause=connect EHOSTUNREACH 0.0.255.255:8080 - Local (10.255.255.255:53107)
```

If this occurs, you must configure your system to route traffic through the firewall or proxy.

> **Note**
>
> For high-level guidance on setting up a reverse proxy to route traffic to Coveo, see [Proxying traffic to Coveo: High-level guidance](https://docs.coveo.com/en/pbee0400/).

> **Important**
>
> To use the Coveo CLI with a firewall or proxy, it must not block the Coveo endpoint: `+https://platform.cloud.coveo.com+`.
> 
> If your organization is [multi-region](https://docs.coveo.com/en/2976#multi-region-deployments), has [data residency outside the US](https://docs.coveo.com/en/2976#data-residency), or is [HIPAA-compliant](https://docs.coveo.com/en/1853/), you must allow [the relevant endpoint](https://docs.coveo.com/en/1445/) **in addition to** the standard Coveo endpoint.

## Set `HTTPS_PROXY`

If you have a firewall or HTTP proxy, you must set the `HTTPS_PROXY` environment variable with the domain or IP address of your proxy server.
The exact command depends on your operating system.

On MacOS or Linux:

```bash
export HTTPS_PROXY=https://<MY_USERNAME>:<MY_PASSWORD>@<MY_PROXY>
```

On Windows:

```bash
set HTTPS_PROXY=https://<MY_USERNAME>:<MY_PASSWORD>@<MY_PROXY>
```

where you replace `<MY_USERNAME>` and `<MY_PASSWORD>` with your username and password respectively, and `<MY_PROXY>` with the URL and port of your proxy server (for example, `proxy.example.com:8080`).

## Set `NODE_EXTRA_CA_CERTS`

If your proxy requires an extra certificate authority, or if you set the `HTTPS_PROXY` environment variable and still see error messages, you must set the `NODE_EXTRA_CA` environment variable to point to a certificate file.
If you don't know the location of your certificate, ask your IT department where to find or download it.
The exact command depends on your operating system.

On MacOS or Linux:

```bash
export NODE_EXTRA_CA_CERTS=<FILE_PATH>
```

On Windows:

```bash
set NODE_EXTRA_CA_CERTS=<FILE_PATH>
```

where you replace `<FILE_PATH>` with an absolute path that points to your certificate file (for example, `C:\folder\subfolder\certificate.pem` on Windows).