HTTPS through an HTTP proxy: how CONNECT tunneling works
To reach an HTTPS site through an HTTP proxy, a client commonly uses CONNECT. The client asks the intermediary to create a TCP connection to an exact host and port. After a successful response, the proxy relays bytes in both directions, and the client performs TLS with the destination inside that tunnel.
Key points in one minute
- CONNECT opens a tunnel to an explicit host and port.
- Destination TLS begins after the tunnel succeeds.
- The CONNECT result and the web application's result are different stages.
- Proxy operators should restrict permitted destinations.
Requesting the tunnel
The CONNECT target uses authority form: a name or IP address plus a port. There is no default port for this method, so the client sends one explicitly. The proxy evaluates its access policy and attempts the onward connection.
Switching to tunnel mode
A successful 2xx response means subsequent bytes are relayed in both directions. They are no longer parsed as ordinary HTTP messages on that hop. For HTTPS, those bytes carry the TLS handshake between the client and the destination.
Two independent outcomes
A tunnel can succeed and the website can still return 403, 404, or 500. The reverse is also possible: the site is healthy but the proxy cannot create the tunnel. A checker should store the CONNECT code separately from the application response.
Secure deployment
Allowing CONNECT to arbitrary ports can expose infrastructure to abuse. Operators should restrict destinations to approved workflows, require authorization, and maintain an audit trail. Clients should continue validating the destination certificate.
Practical checklist
- 1Send the exact destination host and port.
- 2Verify CONNECT and destination TLS separately.
- 3Keep certificate verification enabled in production.
- 4Permit only required destinations and ports.
- 5Do not blindly retry requests that may change data.
Sources and documentation
This material is based on primary, official, and technical sources. The article is an original summary written for this knowledge base.