Why APT Doesn't Use CONNECT for Every Download
Ordinary HTTP forwarding and HTTPS tunneling use different proxy conversations. A CONNECT-only service may not support the requests an HTTP repository produces.
“The proxy accepts CONNECT” does not mean it accepts every request APT will send.
For an ordinary HTTP repository, APT can use normal HTTP proxy forwarding: the proxy receives an HTTP request identifying the destination resource. For HTTPS through an HTTP proxy, the client normally establishes a CONNECT tunnel, then negotiates the destination's TLS session through it.
| Destination | Typical conversation with an HTTP proxy |
|---|---|
| HTTP repository | Forward an HTTP request |
| HTTPS repository | CONNECT, then destination TLS |
A service accepting only tunnels can reject an ordinary forwarded request. An HTTP 405 deserves a look at the actual method, response issuer, and proxy policy; it does not prove that APT lacks SOCKS support or that its password is wrong.
Compare the service's supported behavior with the APT transport documentation and CONNECT semantics. Use a compatible approved service or a supported repository URL. For public repositories where public intermediaries are allowed, the HTTP proxy list offers candidates to check against those requirements. Do not assume adding https:// to the proxy address changes the repository's protocol or turns every request into a tunnel.