An HTTPS proxy is a proxy server that relays encrypted HTTPS traffic between a client and a website. The client sends an HTTP CONNECT request naming the destination host and port. The proxy then opens a tunnel and forwards data in both directions. TLS runs end to end inside that tunnel, so the proxy sees where the traffic goes but not what it contains.

An HTTPS proxy typically works via the HTTP CONNECT method, which opens a tunnel through the proxy over which the client and destination server negotiate end-to-end TLS encryption, rather than inspecting the traffic. This means the proxy provider itself cannot see the content of your requests, only the destination and volume of traffic, a meaningful distinction for anyone weighing the privacy tradeoffs of routing traffic through a third party.

The CONNECT method it relies on establishes a tunnel through which the client and destination encrypt their traffic end-to-end, so the proxy sees only the destination address, never the decrypted contents of the request.

Encrypting the Connection to the Proxy

  • Plain tunneling proxy: The client talks to the proxy over plain HTTP and sends CONNECT host:port. Only the traffic inside the tunnel is encrypted, so the destination host and port in that request travel unencrypted to the proxy.
  • Proxy reached over TLS: Some clients also encrypt the hop to the proxy. In curl, a proxy URL starting with https:// makes curl open a TLS connection to the proxy and verify the proxy's certificate before continuing.
  • Separate trust settings: curl lets you check the proxy's certificate against a different CA file (--proxy-cacert) than the one used for the destination site.

TLS Interception Proxies

Some HTTPS proxies decrypt traffic instead of tunneling it. They act as a man-in-the-middle: the proxy ends the client's TLS session, inspects the content, then re-encrypts it and forwards it to the real server. To avoid browser warnings, administrators must install a certificate the client trusts on each device. CISA warns that the client can then only verify its connection to the interception product, not to the destination server.