Protocols

What is HTTPS Proxy?

An HTTPS proxy carries encrypted TLS traffic between a client and a destination site, usually by opening a tunnel with the HTTP CONNECT method to port 443. The proxy relays raw bytes without reading the request path, headers or body. The term also describes a proxy whose own listening port accepts a TLS-encrypted client connection.

A client that wants https://example.com through a proxy first sends CONNECT example.com:443 HTTP/1.1 with a Host line and, when the proxy requires credentials, a Proxy-Authorization header. The proxy answers 200 Connection established, or 407 Proxy Authentication Required when the credentials are missing or wrong. After that 200 the TCP socket becomes a dumb pipe, and the TLS handshake and every byte after it travel end to end between browser and origin. The proxy's own listening port is arbitrary, with 8080, 3128 and 8888 all common, and it has nothing to do with 443.

Because the payload is encrypted, the operator sees the destination host and port from the CONNECT line, the SNI field in the ClientHello, packet sizes and timing. Request URLs, cookies and response bodies stay hidden. That is the difference from a plain HTTP proxy, which parses the full request line and can rewrite headers on the way through. It also means a provider cannot inject or strip content on an HTTPS connection without breaking the certificate chain, and the client would notice.

Interception proxies such as mitmproxy or a corporate TLS-inspection gateway get around this by terminating the handshake themselves and re-signing certificates with a private CA the machine has been told to trust. Anything using certificate pinning refuses that connection outright. The second sense of the term is a proxy endpoint you reach over TLS, so the CONNECT line and your credentials are encrypted on the local hop instead of crossing the network in the clear. Many commercial endpoints still speak plain HTTP on that hop, with TLS only end to end.

Client libraries usually take one proxy URL for both cases. curl -x http://user:pass@host:port https://target sends the CONNECT over an unencrypted proxy hop, while -x https://... asks curl to wrap that hop in TLS, which needs a reasonably recent build. Node's core http and https modules have historically ignored proxy environment variables, so a tunnelling agent has to be attached per request there. Once the tunnel is open, HTTP/2 negotiates through it normally, because ALPN happens inside the encrypted stream and the proxy never sees it.

Where you meet it

You meet the CONNECT path the first time a proxy works for http:// URLs and fails on https:// ones, or when a debugging proxy shows only a host and port where you expected full requests. It also decides what you can inspect. With an HTTPS tunnel your logging has to live in the client, since the proxy has nothing readable to record. Provider dashboards reporting per-domain usage are reading CONNECT lines and SNI, not URLs.

Common questions

Does an HTTPS proxy encrypt my traffic?

The encryption comes from TLS between your client and the destination site, not from the proxy. The proxy only relays the encrypted bytes. The hop to the proxy itself is plain TCP unless the endpoint accepts a TLS connection, which is worth checking if you are sending proxy credentials over an untrusted network.

Can an HTTPS proxy see which sites I visit?

Yes. The CONNECT request names the destination host and port, and the SNI field in the TLS ClientHello repeats it unless Encrypted Client Hello is in play. The proxy operator can log every hostname you reach, along with timing and byte counts, while URLs, cookies and page content stay unreadable.

Why does my proxy work for HTTP but not HTTPS?

Usually the endpoint or your client is not handling the CONNECT method. Some proxies forward plain GET requests while rejecting CONNECT outright, and some libraries need an explicit tunnelling agent before they will open a tunnel at all. A 405 or 403 in response to CONNECT points at the proxy, while a hang points at a port the network is blocking.

Related terms

HTTP Proxy
An HTTP proxy is a server that forwards HTTP requests on a client's behalf, parsing the protocol rather than blindly relaying bytes. The client sends the full target URL in the request line, or issues a CONNECT to tunnel an HTTPS session. Proxies conventionally listen on ports such as 8080 or 3128; port 80 belongs to the origin web server.
SOCKS5
SOCKS5 is a session-layer proxy protocol, defined in RFC 1928, that relays TCP connections and can relay UDP datagrams for any application rather than only web traffic. It negotiates an authentication method first, then takes a target given as an IPv4 address, an IPv6 address or a domain name and forwards bytes without interpreting them.
SOCKS4
SOCKS4 is the earlier version of the SOCKS proxy protocol. It relays TCP connections only and addresses targets by raw IPv4 address, with no authentication beyond a user ID string the proxy may ignore. The SOCKS4a extension adds hostname support. SOCKS5 superseded it, and current clients keep SOCKS4 only for legacy endpoints.
SSL/TLS
SSL and TLS are the protocols that encrypt and authenticate traffic between a client and a server. SSL is the deprecated original; TLS is what runs today, with TLS 1.2 and TLS 1.3 the only versions current software should negotiate. The handshake proves the server's identity with a certificate, then agrees the keys used for the session.
HTTP/2
HTTP/2 is a binary version of HTTP that carries many concurrent requests as multiplexed streams over a single TCP connection and compresses headers with HPACK. It keeps HTTP's methods, status codes and header semantics unchanged, so only the wire format differs. Browsers negotiate it during the TLS handshake through ALPN, advertising the identifier h2.
HTTP/3
HTTP/3 is HTTP carried over QUIC, which runs on UDP and builds the TLS 1.3 handshake into the transport itself. It keeps HTTP semantics and HTTP/2-style multiplexing while removing TCP's head-of-line blocking, so a lost packet stalls only its own stream. Clients discover it from an Alt-Svc header or an HTTPS DNS record and negotiate it as h3.
QUIC
QUIC is an encrypted transport protocol that runs over UDP instead of TCP and carries HTTP/3 traffic, normally on UDP port 443. It combines the transport and TLS 1.3 handshakes into one exchange and multiplexes independent streams without head-of-line blocking. The protocol identifies a connection by an ID rather than by an address and port pair.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.