DownloadCodex Unofficial guide
English

Fix Codex connection errors behind a corporate proxy or TLS inspection

If your company network inspects TLS with a private root certificate, Codex can fail to sign in or connect. Set the CODEX_CA_CERTIFICATE environment variable to a PEM bundle that contains your organization's root CA, then run codex login again. If that variable isn't set, Codex falls back to SSL_CERT_FILE.

Applies to: Codex CLI, Corporate networks

Fix

export CODEX_CA_CERTIFICATE=/path/to/corporate-root-ca.pem
codex login

On Windows PowerShell:

$env:CODEX_CA_CERTIFICATE = "C:\path\to\corporate-root-ca.pem"
codex login

According to OpenAI, the same custom CA setting applies to sign-in, normal HTTPS requests, and secure WebSocket connections. Add the export line to your shell profile to make it permanent.

Still failing?

  • Run codex login and check codex-login.log in your log directory.
  • Confirm the file is PEM, a text file starting with -----BEGIN CERTIFICATE-----.
  • Ask IT whether chatgpt.com and OpenAI’s API domains are allowed through the proxy.

Questions people ask

Where do I get the certificate file?

From your IT or security team. Ask for the corporate root CA in PEM format. Don't download certificates from unofficial sources.

Sources

We link to the official source for every instruction on this page. If anything here disagrees with them, trust the official source and tell us.

Read next