## TL;DR
The download fails because the tester box cannot reach the template release host: blocked egress, a stale release URL, or a proxy misconfiguration. Confirm outbound HTTPS works, check proxy env vars, retry, and pin a known template version in your engagement notes so runs stay reproducible.

```text
failed to download template archive
```

## Use this when
- `nuclei -update-templates` errors with `failed to download template archive`.
- The failure happens at engagement setup, before any scan runs.
- Templates are stale or missing on the tester box.

## Not for this skill when
- The update succeeds but a template fails to load. That is a template validation problem.
- You are offline by design. Pre-seed templates from an allowed channel instead.
- The error names a specific template file. Validate that file instead.

## Steps
1. Confirm outbound HTTPS from the tester box: `curl -sI https://github.com | head -1`. Verify: you get an HTTP 200/301, not a timeout.
2. Rerun the update with verbose output and watch which URL fails. Verify: the failing host is identified.
3. Check proxy env vars (`http_proxy`, `https_proxy`, uppercase variants). If the engagement uses a proxy, export them; if not, unset them. Verify: curl to the template host works with the same settings.
4. Retry `nuclei -update-templates`. Verify: the template directory populates with current files.
5. Record the template version (git hash of the template dir) in the engagement notes. Verify: a teammate can reproduce the exact template set.

## Variant phrasings
### nuclei update templates download failed
Common phrasing of the same error.
### nuclei failed to download template archive proxy
The proxy-flavored search.
### nuclei templates not updating
Symptom-level phrasing.

Compatibility: nuclei v2/v3. Template sources moved over time; the config file's template URL must match your nuclei version.

## Why it happens
Nuclei pulls a compressed archive of community templates from a release host. Lab and client networks often block that host, or a proxy env var left over from another engagement sends the request nowhere. A stale config pointing at a moved release URL fails the same way.

## Edge cases / pitfalls
- Do not disable TLS verification to make the download work. Fix the network path instead.
- Partial downloads leave a corrupt template dir. Delete it and re-download clean rather than merging.
- If the engagement forbids external downloads, get the archive through the client's approved channel and document the exception.
- Pinning matters: templates change weekly, and a finding must be reproducible with the version you ran.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xztNX5DDRVWcTbnjxR40lQ