Module 12 · Network & Transport
Proxy & SSL Lab
Four realistic enterprise scenarios you'll actually hit in the field: a certificate the browser doesn't trust, a proxy configuration that changes per environment, a corporate proxy that demands its own login, and a VPN gate in front of an internal network. Experience each one first, then see exactly how automation handles it.
SSL Certificate Warning
A separate, realistic mini-app opens in a new tab — the exact page a browser shows when it can't verify a site's certificate. Work through it, then come back here to see how automation handles it.
SSL Test Site
A demo origin whose certificate the browser doesn't trust — self-signed, the way most internal and staging environments are.
Open SSL Test Site ↗Opens in a new tab.
What you'll experience
Open SSL Test Site
Launches a new tab that renders exactly what Chrome shows for a certificate it can't verify — a real interstitial, not a mockup.
Read the warning
“Your connection is not private” — NET::ERR_CERT_AUTHORITY_INVALID, the same title and error code a real untrusted-certificate page shows.
Click Advanced
Reveals the certificate's issuer, validity window, and the specific reason the trust chain failed to verify.
Click Proceed Anyway
Accepts the risk for this one visit only and continues past the warning to the destination.
Arrive at the Safe Demo Site
A confirmation page explains how automation normally skips this entire flow before it ever renders.
A browser shows an interstitial warning — never lets the page load silently — when it can't build a trust chain from a site's TLS certificate back to a certificate authority it recognizes. NET::ERR_CERT_AUTHORITY_INVALID specifically means the certificate wasn't issued (or trusted) by a known CA — the single most common cause on internal/staging infrastructure, where certs are self-signed or issued by a private internal CA no public browser trusts.
Why this shows up constantly in testing
Staging and internal environments are frequently issued self-signed or internal-CA certificates — real TLS encryption, just not chained to a public CA. A real user hitting that environment sees exactly this warning; so does an automated test unless it's told in advance to trust the connection anyway.
Two ways past it
A human clicks Advanced, reads the certificate details, and clicks Proceed Anyway — an informed, one-time judgment call.
ignoreHTTPSErrors: true on the browser context tells Playwright to trust every certificate for that context — no warning is ever rendered, no click happens, because the check itself is skipped at the network layer.
Proxy Configuration
Switch environments to see a real corporate proxy dashboard change underneath you, then test the connection to see exactly how each environment actually behaves.
Environment
- Host
- —
- Port
- —
- Username
- —
- Password
- —
- SSL Enabled
- —
- PAC File
- —
- Authentication Mode
- —
- Timeout (ms)
- —
- Proxy Type
- —
Current Execution
PROXYNo request executed yet.
Status
Not run yet
Response body
Not run yet
Every environment routes traffic through a different corporate proxy with its own host, port, credentials, and authentication mode — exactly the kind of configuration a real automation suite reads from environment variables or a secrets manager rather than a UI.
Each environment behaves deterministically
DEV always connects cleanly, UAT always demands authentication (407), and PROD always times out (504) until the VPN tunnel from Section 4 is established. Fixed, not random — so a test written against any one of them is reliably repeatable.
Corporate Proxy Authentication
Some proxies don't just forward traffic — they demand their own login first. Experience the 407 challenge and clear it, in a real mini-app that opens in a new tab.
Corporate Network Portal
A protected internal resource sits behind a proxy that requires its own credentials before it will forward the request.
Open Corporate Network Portal ↗Opens in a new tab.
What you'll experience
Open Corporate Network Portal
Launches a new tab showing an internal-looking company portal — the kind of landing page behind a corporate proxy.
Click Access Internal Resource
Attempts to reach a protected internal resource through the corporate proxy.
See 407 Proxy Authentication Required
The proxy itself — not the destination server — rejects the request until it sees valid credentials.
Authenticate
Enter the proxy username and password and submit.
Arrive at the Internal Dashboard
A real internal-looking dashboard confirms the proxy accepted the credentials and let the request through.
HTTP 407 Proxy Authentication Required is the proxy equivalent of a 401 — it means the intermediary you're routing through rejected the request, not the final destination server. The destination may never even see the request until the proxy is satisfied.
Why corporate proxies add their own login
Enterprises use proxy-level authentication to attribute every outbound request to a specific employee or service account — useful for audit trails, egress policy enforcement, and compliance reporting, independent of whatever authentication the destination application itself requires.
VPN Required
A browser can't truly connect an operating-system VPN — this mini-app simulates the experience as realistically as possible, and the Learn More below explains exactly where the simulation ends and reality begins.
Internal Banking Portal
An internal application that refuses to load anything until it detects a secure VPN tunnel.
Open Internal Banking Portal ↗Opens in a new tab.
What you'll experience
Open Internal Banking Portal
Launches a new tab for an internal application that first checks whether the device is on the corporate VPN.
See “VPN not detected”
The portal blocks access and explains that a secure tunnel is required before it will proceed.
Click Connect VPN
Starts a simulated connection sequence: Connecting… → Authenticating… → Creating secure tunnel… → Tunnel Established.
Click Continue
Only enabled once the simulated tunnel reaches Tunnel Established — mirrors a real VPN client unlocking network access.
Arrive at the Internal Portal
A confirmation page explains, in plain terms, why this step can never be truly automated by Playwright itself.
Playwright cannot connect a VPN
This is a genuine capability boundary, not a missing feature. Playwright automates a browser; a VPN operates below the browser, at the operating system's network stack. The OS — or the CI runner — must already have VPN access established before Playwright even launches. That distinction matters: conflating the two leads teams to write tests that quietly do nothing.
What follows is the most realistic simulation that can honestly be built inside a browser tab: a portal that gates on a simulated tunnel state, with a clearly-explained animation standing in for what a real VPN client does outside the browser entirely.