TLS through a proxy: which certificates are verified
A proxy route does not remove server identity verification. For an HTTPS destination inside CONNECT, the client validates the destination certificate. If the proxy itself uses HTTPS, there is another TLS connection to the proxy with its own validation. These layers have different names, certificates, and trust settings.
Key points in one minute
- The destination certificate is validated inside the tunnel.
- An HTTPS proxy has a separate certificate and trust chain.
- The certificate identity must match the connection name.
- Disabling verification is suitable only for a short laboratory diagnosis.
TLS to the destination
After CONNECT succeeds, the client performs a TLS handshake with the site. It validates the certificate signature, chain to a trusted CA, and the URL hostname. A proxy cannot make an invalid destination certificate valid.
TLS to an HTTPS proxy
When the proxy scheme is HTTPS, TLS is established between client and proxy first. curl provides separate CA and verification options for this layer. A CONNECT tunnel and a second TLS session to the site can then run inside it.
Sources of trust
Depending on build and platform, a client uses an operating-system or file-based CA store. Add an internal business CA through managed configuration. Replacing the store with an unverified certificate simply creates a different security weakness.
Why insecure is not a fix
An insecure option removes a critical identity check and permits an impostor endpoint. It can briefly confirm that trust is the failing stage, but the proper response is to fix hostname, chain, or CA and restore full validation before production use.
Practical checklist
- 1Identify whether the proxy uses HTTP or HTTPS.
- 2Separate proxy certificate errors from destination errors.
- 3Check certificate name, validity, and chain.
- 4Install a trusted CA through managed configuration.
- 5Confirm that insecure mode is off after diagnostics.
Sources and documentation
This material is based on primary, official, and technical sources. The article is an original summary written for this knowledge base.