Use the Destination's Identity for Java TLS over SOCKS

The SOCKS endpoint gets you to the website. The TLS peer inside that connection is the website itself, so pass the destination hostname to the layered socket factory:

String destination = "example.com";
int destinationPort = 443;
Proxy proxy = new Proxy(
    Proxy.Type.SOCKS,
    new InetSocketAddress("127.0.0.1", 1080)
);

try (Socket transport = new Socket(proxy)) {
    transport.connect(
        InetSocketAddress.createUnresolved(destination, destinationPort),
        5000
    );
    SSLSocketFactory factory =
        (SSLSocketFactory) SSLSocketFactory.getDefault();
    try (SSLSocket tls = (SSLSocket) factory.createSocket(
            transport, destination, destinationPort, true)) {
        SSLParameters parameters = tls.getSSLParameters();
        parameters.setEndpointIdentificationAlgorithm("HTTPS");
        tls.setSSLParameters(parameters);
        tls.setSoTimeout(15000);
        tls.startHandshake();
        // Send the application's HTTPS request through tls.
    }
}

The fragment assumes standard Java networking and TLS imports, an existing default trust configuration and a SOCKS connection needing no proxy credentials. It performs the handshake; the application still needs to send an HTTP request in the server's expected format. For public HTTPS targets on permitted public routes, the SOCKS proxy list offers candidate endpoints; match the server's version and hostname support to this Java socket path.

Read the two identities in the example

127.0.0.1:1080 is the proxy endpoint, reachable from this Java process. destination and destinationPort identify the website. createUnresolved retains that hostname for the SOCKS path instead of resolving it eagerly on the client.

The layered createSocket receives the destination identity. setEndpointIdentificationAlgorithm("HTTPS") explicitly requests its hostname checks. A raw SSLSocket's certificate-chain trust does not by itself establish that hostname verification is enabled. Substituting the proxy's name or loopback to suppress a mismatch can authenticate the wrong endpoint.

Keep trust and cleanup with their stages

The default factory uses the JVM's configured trust arrangement. An application with private requirements can instead use its appropriately initialized SSLContext factory. That choice is separate from the SOCKS route; a trust manager accepting every certificate does not repair a wrong peer name.

A SOCKS rejection occurs before TLS; an untrusted certificate or wrong hostname fails during TLS; an HTTP error can follow afterward. Proxy login authorizes the tunnel request rather than authenticating the website inside it.

Closing the layered socket with auto-close enabled closes its transport. The outer resource scope also closes that transport if wrapping or handshaking fails before normal completion.