What is HTTPS Proxy?
An HTTPS proxy carries encrypted TLS traffic between a client and a destination site, usually by opening a tunnel with the HTTP CONNECT method to port 443. The proxy relays raw bytes without reading the request path, headers or body. The term also describes a proxy whose own listening port accepts a TLS-encrypted client connection.
A client that wants https://example.com through a proxy first sends CONNECT example.com:443 HTTP/1.1 with a Host line and, when the proxy requires credentials, a Proxy-Authorization header. The proxy answers 200 Connection established, or 407 Proxy Authentication Required when the credentials are missing or wrong. After that 200 the TCP socket becomes a dumb pipe, and the TLS handshake and every byte after it travel end to end between browser and origin. The proxy's own listening port is arbitrary, with 8080, 3128 and 8888 all common, and it has nothing to do with 443.
Because the payload is encrypted, the operator sees the destination host and port from the CONNECT line, the SNI field in the ClientHello, packet sizes and timing. Request URLs, cookies and response bodies stay hidden. That is the difference from a plain HTTP proxy, which parses the full request line and can rewrite headers on the way through. It also means a provider cannot inject or strip content on an HTTPS connection without breaking the certificate chain, and the client would notice.
Interception proxies such as mitmproxy or a corporate TLS-inspection gateway get around this by terminating the handshake themselves and re-signing certificates with a private CA the machine has been told to trust. Anything using certificate pinning refuses that connection outright. The second sense of the term is a proxy endpoint you reach over TLS, so the CONNECT line and your credentials are encrypted on the local hop instead of crossing the network in the clear. Many commercial endpoints still speak plain HTTP on that hop, with TLS only end to end.
Client libraries usually take one proxy URL for both cases. curl -x http://user:pass@host:port https://target sends the CONNECT over an unencrypted proxy hop, while -x https://... asks curl to wrap that hop in TLS, which needs a reasonably recent build. Node's core http and https modules have historically ignored proxy environment variables, so a tunnelling agent has to be attached per request there. Once the tunnel is open, HTTP/2 negotiates through it normally, because ALPN happens inside the encrypted stream and the proxy never sees it.
Where you meet it
You meet the CONNECT path the first time a proxy works for http:// URLs and fails on https:// ones, or when a debugging proxy shows only a host and port where you expected full requests. It also decides what you can inspect. With an HTTPS tunnel your logging has to live in the client, since the proxy has nothing readable to record. Provider dashboards reporting per-domain usage are reading CONNECT lines and SNI, not URLs.
Common questions
Does an HTTPS proxy encrypt my traffic?
The encryption comes from TLS between your client and the destination site, not from the proxy. The proxy only relays the encrypted bytes. The hop to the proxy itself is plain TCP unless the endpoint accepts a TLS connection, which is worth checking if you are sending proxy credentials over an untrusted network.
Can an HTTPS proxy see which sites I visit?
Yes. The CONNECT request names the destination host and port, and the SNI field in the TLS ClientHello repeats it unless Encrypted Client Hello is in play. The proxy operator can log every hostname you reach, along with timing and byte counts, while URLs, cookies and page content stay unreadable.
Why does my proxy work for HTTP but not HTTPS?
Usually the endpoint or your client is not handling the CONNECT method. Some proxies forward plain GET requests while rejecting CONNECT outright, and some libraries need an explicit tunnelling agent before they will open a tunnel at all. A 405 or 403 in response to CONNECT points at the proxy, while a hang points at a port the network is blocking.
Related terms
Real 4G/5G mobile and residential IPs
PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.