AI Proxies and Private CAs

Corporate upstream proxy

When the customer network requires Zscaler or another forward proxy, configure it as the upstream hop for egress-ironproxy. Do not point backend or worker directly at the corporate proxy.

/opt/packetsafari/bin/packetsafari-ops config upstream-proxy \
  --proxy-url http://proxy.company.example:8080 \
  --no-proxy localhost,127.0.0.1,::1 \
  --restart

Backend and worker should continue using PacketSafari's internal egress proxy. The supported upstream path is standard HTTP proxy chaining through HTTP_PROXY and HTTPS_PROXY; PAC files, NTLM/Kerberos proxy authentication, and SOCKS-only proxies are not directly supported.

Private CA or self-signed endpoint

Host approval and TLS trust are separate. An internal HTTPS model endpoint often needs both.

python3 scripts/packetsafari_custom_ca.py add \
  /path/to/company-root-ca.crt \
  --restart

After installing the CA:

1. approve the endpoint host when it is outside the container network
2. restart egress-ironproxy
3. run Test connection again

Useful maintenance commands:

python3 scripts/packetsafari_custom_ca.py list
python3 scripts/packetsafari_custom_ca.py remove company-root-ca.crt --restart
python3 scripts/packetsafari_proxy_ca.py status
python3 scripts/packetsafari_proxy_ca.py check --rotate-if-needed --rotate-before-days 30