Skip to content
Get Started
G2G2
4.7/5
Excellent
Trustpilot

What Is an HTTPS Proxy and the CONNECT Method?

An HTTPS proxy usually means an HTTP proxy that carries https:// traffic through a tunnel opened with the CONNECT method. The client asks the proxy to connect to a host and port, then runs TLS straight to the website, so the proxy relays encrypted bytes it cannot read.

Try Now for $4.99Continue with Google
  • Session Control
  • High Speed
  • Privacy First
Best fit for HTTPS proxyStatic ISP Proxiesfrom$0.75/IP
how it works

How the CONNECT method works

CONNECT is defined in section 9.3.6 of RFC 9110. Instead of a URL, the request target is a host and port. The proxy opens a TCP connection to that address and, if it succeeds, answers with a 2xx status. From then on the connection is a blind tunnel: the client starts the TLS handshake with the website, checks the website's certificate and sends its real request inside the encrypted channel.

If the credentials are missing or wrong, the proxy answers 407 Proxy Authentication Required instead of 200 and no tunnel is opened.

A CONNECT exchangeText
CONNECT example.com:443 HTTP/1.1
Host: example.com:443
Proxy-Authorization: Basic dXNlcm5hbWU6cGFzc3dvcmQ=

HTTP/1.1 200 Connection established
why it matters

Why CONNECT matters for proxy users

Most web traffic is HTTPS, so nearly every request you send through a proxy runs inside a CONNECT tunnel. That has practical consequences:

HTTPS proxy: what it means for you
  • The proxy cannot change your headers, cookies or User-Agent inside the tunnel. The website sees exactly what your client sends.
  • The proxy still sees the hostname and port in the CONNECT line; the hostname also appears in the TLS SNI field.
  • Errors come from two places. A 407 or 502 comes from the proxy during CONNECT; a 403 or 429 comes from the website inside the tunnel. The proxy errors guide covers the common ones.
  • Use http:// in the proxy URL even for https:// sites, unless your provider says the proxy itself accepts TLS.
side by side

Two things called an HTTPS proxy

The term is used for different setups, and the proxy URL scheme tells you which one you have.

  • 1

    HTTP proxy with CONNECT (http://HOST:PORT)

    Client to proxy
    Plain TCP; the CONNECT line and credentials are readable on that hop
    Client to website
    TLS end to end
  • 2

    Proxy reached over TLS (https://HOST:PORT)

    Client to proxy
    Encrypted, credentials included
    Client to website
    TLS inside the TLS connection to the proxy
  • 3

    TLS-intercepting proxy

    Client to proxy
    Varies
    Client to website
    The proxy decrypts traffic with its own certificate, which your device must trust; used on corporate networks, not by proxy services

CleanProxies static ISP proxies open CONNECT tunnels for https:// sites with username:password or IP whitelisting, and keep the same IP all month.

Static ISP proxies from $0.75/IP

The CleanProxies proxy that fits best here, with a $4.99 trial to test it first.

Static ISP Proxies

Best fit

Dedicated IPs on US carrier ASNs with unlimited bandwidth and threads, never shared.

starting from$0.75/IP

Dedicated static IPs registered to US and Canadian ISPs. The address stays the same for as long as you hold it, with unlimited bandwidth and HTTP(S) or SOCKS5 access.

Buy NowSee Static ISP Proxies features

Go deeper

Guides from the blog

Setup guides and best practices from the CleanProxies blog.

Get the latest insightsAll Blogs

Related terms

Terms that come up alongside HTTPS proxy.

All glossary terms

HTTPS proxy FAQs

Straight answers about HTTPS proxy.

Not the content. A CONNECT proxy sees the destination hostname, port, timing and amount of data, but the pages, headers and cookies are encrypted between your client and the website.

Got more questions?All FAQs