Find Which Chocolatey Download Needs the Proxy
Bootstrap, the installed CLI and a package's separate downloader can read different proxy inputs.
Identify the failed request before changing Chocolatey's proxy settings:
| Failure phase | Proxy input to inspect |
|---|---|
| Obtaining Chocolatey before choco exists | The bootstrap shell's chocolateyProxyLocation and optional account variables |
| An installed choco operation | Its priority order: explicit command arguments, Chocolatey configuration, environment variables, then system configuration |
| A package starts another downloader | The options and identity of that process; it may use Chocolatey's helpers or separate software |
A saved choco config value cannot configure the earlier bootstrap download. Use the official installation method for the managed environment with its proxy values in the shell that actually runs it. An old one-line installer that changes execution policy and embeds a password is not a necessary proxy repair.
For an installed CLI, inspect the effective configuration at the intended scope. A saved CLI value can explain why changing Windows' system proxy made no difference. For permitted public downloads whose actual downloader has no configured or retained proxy credentials, the HTTP proxy list offers candidate addresses for the applicable proxy input; use the chosen client's expected format. Keep the intermediary endpoint and account separate from package-source credentials; repository authentication can fail after proxy access succeeds.
During package installation, identify the process emitting the error. A separate executable need not implement Chocolatey-specific options or use the same identity. Graphical tools and background agents also have product-specific proxy limitations; a successful CLI request does not establish their icon-download or agent route.
Read the first useful failure with that process in mind: 407 concerns proxy authentication, a TLS trust error concerns the certificate presented to that requester, and a missing package or rejected repository account concerns the source. Preserve the failing hostname, operation, account context and status with secrets removed. Bootstrap success followed by a failed package download narrows the path that needs repair.