Skip to content
HTTP and TLS

HTTPS through an HTTP proxy: how CONNECT tunneling works

To reach an HTTPS site through an HTTP proxy, a client commonly uses CONNECT. The client asks the intermediary to create a TCP connection to an exact host and port. After a successful response, the proxy relays bytes in both directions, and the client performs TLS with the destination inside that tunnel.

2 min readReviewed and updated: August 6, 2026

Key points in one minute

  • CONNECT opens a tunnel to an explicit host and port.
  • Destination TLS begins after the tunnel succeeds.
  • The CONNECT result and the web application's result are different stages.
  • Proxy operators should restrict permitted destinations.

Requesting the tunnel

The CONNECT target uses authority form: a name or IP address plus a port. There is no default port for this method, so the client sends one explicitly. The proxy evaluates its access policy and attempts the onward connection.

Switching to tunnel mode

A successful 2xx response means subsequent bytes are relayed in both directions. They are no longer parsed as ordinary HTTP messages on that hop. For HTTPS, those bytes carry the TLS handshake between the client and the destination.

Two independent outcomes

A tunnel can succeed and the website can still return 403, 404, or 500. The reverse is also possible: the site is healthy but the proxy cannot create the tunnel. A checker should store the CONNECT code separately from the application response.

Secure deployment

Allowing CONNECT to arbitrary ports can expose infrastructure to abuse. Operators should restrict destinations to approved workflows, require authorization, and maintain an audit trail. Clients should continue validating the destination certificate.

Practical checklist

  1. 1Send the exact destination host and port.
  2. 2Verify CONNECT and destination TLS separately.
  3. 3Keep certificate verification enabled in production.
  4. 4Permit only required destinations and ports.
  5. 5Do not blindly retry requests that may change data.

Sources and documentation

This material is based on primary, official, and technical sources. The article is an original summary written for this knowledge base.

  1. 1.RFC Editor / IETF: HTTP Semantics
  2. 2.MDN Web Docs / Mozilla: CONNECT request method
  3. 3.curl project: curl Tutorial

Continue reading

More articles on related topics

Protocols

HTTP proxies: what happens to a web request

Read

Protocols

SOCKS5 explained: negotiation, addressing, and relay setup

Read

SOCKS5

CONNECT, BIND, and UDP ASSOCIATE in SOCKS5

Read