When a program asks an HTTP proxy for an https address, it sends the word CONNECT with the site's name and port. The proxy opens a raw connection to the site and from then on only passes bytes back and forth. The encryption is between your program and the site, so the proxy sees which site you reached and how much data moved, not what it said.
In practice this means one proxy address covers both kinds of site. The proxy address itself still starts with http://, even when the page you fetch is https. Writing https:// in front of the proxy host is a common mistake and makes most programs fail to connect.
Questions about HTTPS through a proxy
Can the proxy read my https traffic?
No. It sees the name of the site you connect to and how much data moves. The contents are encrypted between your program and the site.
Why do I get an SSL error through a proxy?
Usually because the proxy address was written with https:// instead of http://, or because a security tool on your computer is inspecting the connection. The proxy address starts with http:// even when the page is https.
Related terms
- HTTP proxy
- An HTTP proxy is a proxy that speaks the web's own protocol. Almost every program supports it, and it carries both http and https sites.
- SOCKS5 proxy
- A SOCKS5 proxy passes any kind of network connection, not only web pages, and can sign you in with a username and password.
- TLS fingerprint
- A TLS fingerprint is the pattern in how a program opens an encrypted connection. It reveals whether the visitor is a browser or a script.
Read next: Code examples for curl, Python and Node.js