Inspect a Failed Proxy CONNECT Response Body with curl

A proxy rejecting CONNECT can return an HTTP error document explaining its policy or onward connection failure. For an authorized diagnostic against an ordinary HTTP proxy, curl can send that request directly and save the reply:

curl --proxy '' --http1.1 --max-time 10 \
  --request CONNECT \
  --request-target service.example:443 \
  --header 'Host: service.example:443' \
  --dump-header tunnel.headers \
  --output tunnel.body \
  http://proxy.example:8080/

The final URL addresses the proxy listener. For an allowed public-proxy comparison, the HTTP proxy list provides candidates for that listener URL. --request supplies the method token; --request-target supplies the CONNECT authority. Keeping them separate produces CONNECT service.example:443 HTTP/1.1.

The empty proxy option prevents curl from routing this diagnostic through another inherited proxy. The command deliberately omits --fail so an HTTP error document can be retained.

An unauthenticated attempt may stop at 407 before reaching the failure being investigated. Use the proxy's intended authentication arrangement when reproducing an authenticated request.

This is for inspecting failure responses. If the proxy returns 2xx, the connection becomes a tunnel rather than an ordinary HTTP body transfer. This custom-method diagnostic does not start the destination's TLS exchange and can reach its time limit on an accepted open tunnel.

Use the normal --proxy request flow for an actual HTTPS fetch. Keep the diagnostic status and body with their specific proxy and target.