PAC File Delivery Must Work Before Proxy Configuration

A PAC file tells a browser how to reach other services. Its own delivery must work before those instructions are available.

Chromium's PAC downloader is not an ordinary tab request. Its proxy documentation says PAC files are never fetched through a proxy. A PAC URL reachable only through the proxy named inside that file therefore creates a bootstrap problem.

There are other delivery constraints: the downloader cannot show a normal HTTP authentication prompt or present a client certificate, and auxiliary certificate-network fetches are restricted. A working tab opened with an already configured browser is insufficient evidence that a fresh PAC fetch can succeed.

Place the file on an endpoint reachable from the intended starting networks, with a trust and access arrangement supported by the actual consumer. Keep the file's delivery requirements separate from the proxy's own user authentication.

For roaming clients, include the network on which configuration first becomes necessary. A cached script can hide a delivery failure until a new profile, expiry, or network change triggers another fetch.

Adding two proxy addresses inside the script cannot repair the route needed to obtain the script itself.