HTTP Proxy vs HTTPS Proxy: What the Label Means
Understand the difference between an HTTP proxy that tunnels HTTPS websites and an HTTPS proxy that encrypts the connection to the proxy itself.
Use the scheme documented for the proxy listener. When choosing candidates from the HTTP proxy list, confirm the listener scheme before configuring your client. An HTTPS website can use http://proxy.example:8080; changing that value to https:// asks for a different kind of connection to the proxy.
| Proxy URL | Website URL | Connection |
|---|---|---|
http://proxy.example:8080 | http://example.com/ | Cleartext HTTP to the proxy and destination. |
http://proxy.example:8080 | https://example.com/ | HTTP CONNECT to the proxy, then destination TLS through the tunnel. |
https://proxy.example:8443 | https://example.com/ | TLS to the proxy, with the destination tunnel carried inside that connection. |
For an ordinary HTTP listener that permits CONNECT, this is consistent:
curl --proxy http://127.0.0.1:8080 https://example.com/The website's TLS handshake happens after the proxy accepts the tunnel. If you change the proxy URL to https:// but the listener only understands cleartext HTTP, TLS negotiation with the proxy can fail before the website is contacted.
What TLS to the proxy adds
A TLS-enabled proxy protects the client-to-proxy link, including the CONNECT exchange and proxy authentication, against passive observers on that path. The proxy operator still handles the connection and knows the tunnel destination. Both client and listener must support this mode:
curl --proxy https://proxy.example:8443 https://example.com/Use the service's real hostname; its certificate must match and be trusted. Destination and port restrictions still apply.
With HTTPS on both sides, there are two certificate checks. curl lets you configure them separately:
curl --proxy https://proxy.example:8443 --proxy-cacert proxy-ca.pem --cacert origin-ca.pem https://example.com/--proxy-cacert supplies trust for the proxy; --cacert supplies trust for the destination. Use administrator-provided bundles when needed; system trust may already suffice. Identify which handshake failed before changing either.
A proxy list's “HTTPS” label may only mean that the endpoint passed a CONNECT test. Unless the list defines its test, that label alone does not tell you whether the listener expects http:// or https://.