HTTP CONNECT: How an HTTP Proxy Handles HTTPS

Follow an HTTPS request through an HTTP proxy, separate the CONNECT response from the origin response, and identify where a tunnel fails.

“200 Connection Established” is the proxy accepting a tunnel. The website has not returned a page yet. Next comes TLS with the destination, followed by the HTTPS request itself.

From proxy connection to website response

  1. The client connects to the proxy endpoint.
  2. It asks the proxy to connect to a destination host and port.
  3. The proxy accepts or rejects that request.
  4. After acceptance, the client negotiates destination TLS through the tunnel.
  5. The client sends the HTTPS request and receives the website’s response inside TLS.

A refused proxy connection, rejected tunnel and certificate error occur at different points in this sequence. Find the last completed step before changing settings.

The CONNECT exchange

In HTTP/1.1, a simplified exchange is:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443

HTTP/1.1 200 Connection Established

The request target is a host and port, without the website’s path or query. After a successful CONNECT response, the connection carries tunnel bytes. For an HTTPS destination, the client’s next exchange is the TLS handshake.

Read the numeric status rather than matching the English reason phrase. Proxies can use different text for the same status.

Watch it with curl

For an HTTP proxy on local port 8080:

curl --noproxy '' --proxy http://127.0.0.1:8080 --connect-timeout 5 --max-time 15 --verbose https://example.com/

Replace the listener with your endpoint; if you need candidates, browse the HTTP proxy list and test the selected entry. The empty bypass list ensures this invocation selects the proxy. In chronological order, look for the proxy connection, CONNECT response, destination certificate verification and website response. The precise log wording depends on the curl build.

The destination can return 404, 429 or 500 after the proxy accepted the tunnel. It can also fail during TLS before returning any HTTP response.

Where did it stop?

ObservationNext investigation
Connection to the proxy is refusedProxy address, listening port, process and network access.
The proxy returns 407The proxy account and authentication scheme.
The proxy rejects a destination or portAccess policy and permitted CONNECT destinations.
The tunnel opens, then TLS verification failsDestination name, trust store, clock and any managed TLS interception.
TLS succeeds and the website returns an errorThe website’s response.

For comparisons, hold one side steady: try another destination through the same proxy, or compare the same destination over a permitted direct route.

The tunnel still has an operator

The proxy knows the CONNECT destination and handles traffic timing and volume. Ordinary end-to-end TLS protects the website’s application content from a proxy that does not terminate that TLS session. A managed interception proxy trusted by the client has a different trust arrangement.

ХӀокхунах тера йаззамаш