What Is an SSL Proxy?
An SSL proxy, also sold as an HTTPS proxy, is a proxy that carries encrypted HTTPS traffic: in most offers it tunnels your connection to HTTPS sites without reading it, and in a stricter sense it also encrypts the connection between you and the proxy. A third kind, the SSL inspection proxy used on company networks, decrypts traffic on purpose to filter it. ProxyField proxies carry HTTPS sites over HTTP, HTTPS and SOCKS5 on 412M+ residential IPs from $1.95/GB; start with the Easy Trial: 1 GB for $2.95.
- residential IPs
- 412M+
- from, traffic never expires
- $1.95/GB
- Easy Trial
- 1 GB for $2.95
On this page 9 sections
Three things "SSL proxy" can mean
The name is used for three different setups. Which one you have decides who can read your traffic.
| Feature | HTTPS-capable proxy | Proxy reached over TLS | SSL inspection proxy |
|---|---|---|---|
| Also called | SSL proxy, HTTPS proxy | HTTPS proxy, secure proxy | TLS interception, SSL decryption, "man in the middle" proxy |
| Connection from you to the proxy | Unencrypted | Encrypted with TLS | Usually unencrypted, inside a company network |
| Connection to the site | Your own TLS session, end to end | Your own TLS session, end to end | Two sessions: you to the proxy, the proxy to the site |
| Can the proxy read pages? | No; it sees the host name | No; it sees the host name | Yes, everything |
| Needs a certificate on your device | No | No | Yes, the company's root certificate |
| Who uses it | Proxy services, scraping, browsing | Privacy on untrusted networks | Companies and schools filtering traffic |
When a proxy service lists "HTTP/HTTPS" or "SSL" support, it nearly always means the first column: the proxy can carry HTTPS sites.
SSL or TLS?
How HTTPS passes through a proxy
An ordinary HTTP proxy handles HTTPS sites with the CONNECT method. Your client asks the proxy to open a TCP connection to site.com:443, the proxy connects and replies that the tunnel is ready, and your client then runs its TLS handshake directly with the site through the tunnel. The site's certificate reaches your client unchanged, and the proxy relays encrypted bytes it cannot read (MDN: Proxy servers and tunneling).
That is why an "HTTP proxy" works for HTTPS sites, and why most "SSL proxies" are simply HTTP proxies that allow CONNECT to port 443. The full mechanics are in what an HTTP proxy is. With ProxyField, HTTPS sites go through the gateway gate.proxyfield.io:7000 like plain HTTP sites. The gateway tunnels HTTPS with CONNECT and does not decrypt it.
HTTPS proxies: TLS to the proxy itself
In the strict sense, an HTTPS proxy is one you connect to over TLS: the proxy URL starts with https://, and the connection from you to the proxy is encrypted before any request is sent. This protects two things an ordinary HTTP proxy leaves in the clear on your local network: the proxy password, and the CONNECT line with the host name you visit.
Client support varies. curl accepts https:// proxy URLs when it is built with a supported TLS library (curl: --proxy), and Chrome supports HTTPS proxies through PAC files and policies, but many libraries and apps accept only http:// or socks5:// proxy URLs.
# HTTPS site through an HTTP proxy (CONNECT tunnel); the site's TLS runs end to end
curl -x http://<login>:<password>@gate.proxyfield.io:7000 https://api.ipify.orgSSL inspection proxies
An SSL inspection proxy breaks the end-to-end TLS session on purpose. It terminates your TLS connection, reads and filters the content, and opens a new TLS connection to the site. For your browser to accept this, the company installs its own root certificate on your device, and the proxy signs certificates for every site with it.
Companies and schools use these proxies to scan for malware and enforce policies. Outside a managed device there is no reason to accept one: never install a root certificate from a proxy service or a free proxy, because it lets that operator read every HTTPS page you open. A proxy service for data collection should never need one.
Reverse SSL proxies
On the server side, "SSL proxy" can also mean a reverse proxy that handles TLS for a website: it holds the site's certificate, decrypts incoming HTTPS requests and passes them to the servers behind it, often with load balancing and caching. This is called TLS termination or SSL offloading. It is set up by the site's owner, and as a visitor you do not configure it.
Certificate errors through a proxy
With a CONNECT tunnel, the certificate you see is the site's own, so a certificate error through a proxy means something is wrong:
- The proxy, or a network in between, is intercepting TLS. Check the certificate's issuer: if it is not a public certificate authority you recognize, stop.
- Your client's clock or trust store is out of date. Fix the system, not the check.
- You use an HTTPS proxy whose own certificate your client does not trust. curl has a separate switch for that,
--proxy-insecure;-k(--insecure) applies to the site, not the proxy.
Do not turn certificate checks off in a scraper to make an error go away. Find out why the certificate does not match first.
Which one do you need?
- Scraping, browsing or checking sites from other locations: an HTTPS-capable proxy, which every ProxyField protocol is. Through a CONNECT tunnel, your traffic to HTTPS sites stays encrypted end to end.
- Hiding the proxy password and host names from your local network: a proxy reached over TLS, or a VPN; see proxy vs VPN.
- Filtering a company's traffic: an SSL inspection proxy, on devices you manage.
- Serving your own site over HTTPS: a reverse proxy with TLS termination.
For the protocol choice between HTTP(S) and SOCKS5, see SOCKS5 vs HTTP proxy, and for buying, HTTP proxies.
Need proxies for HTTPS sites? ProxyField residential proxies carry HTTPS over HTTP, HTTPS and SOCKS5 on 412M+ IPs in 195+ countries, from $1.95/GB with no subscription. Start with the Easy Trial: 1 GB for $2.95. Traffic never expires, and all purchases are final.
What Is an SSL Proxy? FAQ
What is an SSL proxy?
ProxyField proxies carry HTTPS sites on 412M+ residential IPs, from $2.95/GB for 1 GB down to $1.95/GB, and an SSL proxy is a proxy that carries encrypted HTTPS traffic, usually by tunneling your connection to the site without reading it. On company networks, "SSL proxy" can also mean a proxy that decrypts traffic to inspect it.
What is an HTTPS proxy, and is it the same as an HTTP proxy with SSL?
"HTTPS proxy" means either a proxy that can carry HTTPS sites, which any HTTP proxy with CONNECT does, or a proxy you reach over an encrypted TLS connection. Only the second is literally "HTTP proxy with SSL": the hop from you to the proxy is encrypted too. In both, the site's own TLS runs end to end.
How is an HTTPS proxy different from a plain HTTP proxy?
An HTTP proxy is reached over a plain connection, and it tunnels HTTPS sites with CONNECT; an HTTPS proxy is reached over TLS, so the proxy password and the host names you visit are also encrypted on your local network. Pages from HTTPS sites stay encrypted end to end through either.
What is an SSL proxy used for?
To reach HTTPS sites from another IP for scraping, price and SERP checks or testing, while the content stays encrypted. Companies use SSL inspection proxies to filter traffic, and site owners use reverse SSL proxies to handle TLS in front of their servers.
When should I use an HTTPS proxy?
Use a proxy reached over TLS when the network between you and the proxy is untrusted and your client supports https:// proxy URLs, since it hides the proxy password and the CONNECT host names. For scraping from your own server, an ordinary HTTP proxy is enough: the target pages are encrypted end to end anyway.
Are HTTPS proxies always slower?
No. TLS to the proxy adds one handshake per connection, which is small next to the network distance and the IP behind the proxy. HTTPS sites through an ordinary HTTP proxy cost no extra encryption work at the proxy, because it only relays the tunnel.
Is an HTTPS proxy safer than a standard HTTP proxy?
Slightly, on the network between you and the proxy: TLS hides your proxy password and the host names you open. It does not change what the proxy operator can see, and HTTPS pages are equally protected through both, so choosing a provider you trust matters more.
Do I need to install a certificate to use an HTTPS proxy?
No. Proxies that tunnel HTTPS, and proxies reached over TLS, need no certificate on your device. Only SSL inspection proxies do, because they decrypt your traffic; never install a root certificate from a proxy service.
Does --insecure also ignore an HTTPS proxy certificate?
--insecure also ignore an HTTPS proxy certificate?No. In curl, -k or --insecure skips verification of the site's certificate only; the proxy's certificate has its own switch, --proxy-insecure. Use either only for tests, never in a production scraper.
How do forward and reverse SSL proxies differ?
A forward SSL proxy sits on your side and carries your HTTPS traffic out to sites, as proxy services do. A reverse SSL proxy sits in front of a website, holds its certificate and decrypts visitors' HTTPS requests before passing them to the servers.
Show 1 more questionShow fewer questions
What is an SSL inspection proxy?
It is a proxy that decrypts HTTPS on purpose: it ends your TLS session, inspects the content and opens a new one to the site, using a root certificate installed on your device. Companies use it on managed devices to filter traffic.
Related pages
Easy Trial: 1 GB for $2.95.
Try for the price of 1 GB, no subscription, traffic never expires.