HTTP CONNECT and how an HTTPS proxy works

9 November 2026

CONNECT is an HTTP method that asks a proxy to open a TCP tunnel to a given host and port. Once the proxy agrees, it relays bytes in both directions without reading them, so encryption runs directly between your browser and the site. An "HTTPS proxy" usually means a proxy you reach over TLS, which encrypts the path to the proxy as well.

One name, two different things

"HTTPS proxy" is used in two senses, and mixing them up leads to wrong assumptions about encryption:

• An HTTP proxy carrying https sites. The connection to the proxy is unencrypted; the site's content is encrypted inside a CONNECT tunnel.
• A proxy you connect to over TLS. The connection to the proxy is encrypted from the first byte, including the CONNECT request and your password.

In this article "HTTPS proxy" means the second, as it does in curl and Chromium.

The steps of a CONNECT request

The method is defined in RFC 9110, section 9.3.6. This is what happens when you open an https site through an HTTP proxy:

1. The browser opens a TCP connection to the proxy.
2. It sends a CONNECT request containing only the host name and port, with no path and no body. The port is mandatory: the method has no default port.
3. If the proxy requires authentication and none was sent, it answers 407, and the browser repeats the request with a Proxy-Authorization header.
4. The proxy checks the credentials and that the port is allowed, then opens a TCP connection to the site.
5. It answers with a 2xx success code. Right after the header section of that response, the connection becomes a tunnel.
6. The browser sends its TLS ClientHello through the tunnel and negotiates keys with the site. The proxy carries these messages but never holds the keys.
7. The tunnel stays open until one side closes its connection, at which point the proxy closes the other.

On the wire it looks like this, in an example based on the one in the standard, with the credentials hello:world:

CONNECT server.example.com:443 HTTP/1.1
Host: server.example.com:443
Proxy-Authorization: Basic aGVsbG86d29ybGQ=

HTTP/1.1 200 Connection established

After the blank line that ends the response, the proxy adds nothing of its own. A success response must not carry Content-Length or Transfer-Encoding, because what follows is tunnel data, not a response body.

Why proxies restrict ports

A tunnel carries any protocol, not just the web. The standard warns that tunnelling to arbitrary ports is risky, and gives port 25 as an example: it could turn the proxy into a relay for spam. It recommends that a proxy limit CONNECT to a small set of known ports.

If a proxy refuses a tunnel to a port other than 443, that is most likely deliberate policy rather than a fault.

HTTPS proxies: encrypting the path to the proxy

With an ordinary proxy, the CONNECT request and the Proxy-Authorization header travel in plain text. The Base64 in the example above is an encoding, not encryption, and anyone on the path can decode it.

With an HTTPS proxy, the browser first runs a TLS handshake with the proxy itself and checks its certificate like any site's. It then sends CONNECT inside that encrypted connection.

Once the tunnel is up, a second TLS handshake with the site runs inside the first. The stretch between you and the proxy carries two layers of encryption.

curl supports this with the https:// scheme in the proxy address. Chrome supports it through a PAC file, a policy or an extension. It generally cannot be set through the operating system's proxy settings, according to the Chromium documentation.

Who sees what

For a site served over https in both cases:

SNI is an extension in the ClientHello, defined in RFC 6066, section 3, that tells a server which of the sites sharing its address you want. Through a plain HTTP proxy, it is part of the traffic anyone on the path can observe.

When the proxy does read the content

Some company and school proxies go beyond tunnelling. They end the TLS connection themselves and present the browser with a certificate from their own certificate authority.

Then they open a fresh connection to the site. That way they read everything.

This only works if that authority's root certificate is installed on your device; otherwise the browser shows a warning. To check, open the certificate details of any site in your browser and look at the issuer. If it names your employer or a security product rather than a public certificate authority, your traffic is being intercepted.

What about UDP and HTTP/3

A classic CONNECT tunnel carries TCP only. HTTP/3 runs over QUIC, which runs over UDP, so it cannot pass through that tunnel, and the browser reaches the site over TCP instead.

For carrying UDP through an HTTP proxy, RFC 9298 defines connect-udp. It is a different mechanism from classic CONNECT, and not every proxy or program supports it.

How to test it yourself

curl's -v option shows each step of the tunnel. With an HTTP proxy:

curl -v -x http://USER:PASS@proxy.example.com:8080 https://example.com/

You will see a line starting with > CONNECT example.com:443, the proxy's answer, and then the TLS handshake with the site. With an HTTPS proxy:

curl -v -x https://USER:PASS@proxy.example.com:443 https://example.com/

Here the TLS handshake with the proxy, and its certificate, appear before the CONNECT line. If the proxy's certificate fails, do not skip the check with --proxy-insecure until you know why. To confirm the exit address once connected, open the My IP tool.

General advice

• On a network you do not trust, use an HTTPS proxy or a fully encrypted connection such as a VPN.
• Never install a root certificate you cannot account for. Whoever holds it can read your encrypted traffic.
• Always use https sites. That is what protects the content from the proxy itself.
• If you run a proxy, limit CONNECT to the ports you need, and require authentication.

If you use a proxy with an e-wallet or a bank account, also read Keeping your wallet safe with a proxy or VPN.

At syriaproxy

Our HTTPS proxy is encrypted between your device and our server. SOCKS5 and HTTP proxies are also available, unencrypted, for programs that need them.

Traffic exits from the Syriatel network inside Syria, and we do not log the sites you visit or their content. Setup is in Proxy setup.

FAQ

Check your proxy with the free proxy checker: whether it works, its response time, and its exit address.