OpenSSL s_client Through an HTTP Proxy with Basic Authentication

OpenSSL 3.x s_client provides proxy-user and password-source options for an HTTP CONNECT proxy. For an environment that already exports PROXY_USER and PROXY_PASSWORD:

openssl s_client \
  -proxy proxy.example.net:8080 \
  -proxy_user "$PROXY_USER" \
  -proxy_pass env:PROXY_PASSWORD \
  -connect example.com:443 \
  -servername example.com \
  -verify_hostname example.com \
  -verify_return_error

The actual option names use underscores: -proxy_user and -proxy_pass. The proxy endpoint is host:port, while connect and servername identify the destination.

proxy_pass uses OpenSSL’s password-source syntax. env:PROXY_PASSWORD reads the named environment variable; file:/path/to/file is another documented source form. An unadorned password is not the same argument format.

The shown options request certificate and hostname checking, with verification errors treated as fatal. Supply the appropriate CA configuration, such as a required CAfile, for the installation and destination.

This proxy authentication is Basic authentication. The proxy connection shown is plain HTTP, so the destination’s later TLS handshake does not encrypt that earlier login exchange. It does not implement an NTLM or Kerberos proxy negotiation.