Skip to contentThe HTTP CONNECT Method Explained
CONNECT is the HTTP method that makes HTTPS work through a proxy. Instead of fetching a page, it asks the proxy to open a raw tunnel to a destination so encrypted traffic can pass through untouched. This guide explains how CONNECT works, step by step.
Why CONNECT exists
An ordinary HTTP proxy works by reading your request, fetching the resource, and returning it — it sees and relays the full request and response. That is fine for plain HTTP, but it breaks for HTTPS: the whole point of TLS is that no middleman can read the traffic, so the proxy cannot simply "fetch the page" on your behalf without breaking encryption.
The CONNECT method solves this. Instead of asking the proxy to retrieve something, your client asks the proxy to open a raw TCP tunnel to a host and port and then get out of the way. Once the tunnel is open, your client performs the TLS handshake directly with the destination through the proxy, and the proxy blindly relays the encrypted bytes in both directions. The proxy never sees the plaintext — it only sees an opaque stream and, via the CONNECT line and TLS SNI, the destination hostname. This is how the s4m HTTP proxy on port 3128 carries HTTPS.
How the tunnel is established
The flow is short and specific:
- Your client sends
CONNECT example.com:443 HTTP/1.1to the proxy, with aHostheader and, if required,Proxy-Authorizationcredentials. - The proxy opens a TCP connection to
example.com:443. - If that succeeds, the proxy replies
HTTP/1.1 200 Connection Established. From this moment the connection is a bare tunnel — no more HTTP semantics. - Your client now runs the TLS handshake directly with example.com over that tunnel, and all subsequent application data is end-to-end encrypted.
Two consequences follow. First, TLS stays truly end-to-end: the proxy authenticates nothing and reads nothing inside the tunnel, so certificate validation happens between your client and the real server. Second, because CONNECT just opens a TCP tunnel, proxies can in principle tunnel other TLS-based or arbitrary protocols on other ports — which is exactly why proxies usually restrict CONNECT to port 443 (and a few others) to avoid becoming an open relay.
See CONNECT with curl
curl issues CONNECT automatically for an https:// URL through an HTTP proxy. Use -v to watch the CONNECT request and the '200 Connection Established' response.
# Verbose: watch the CONNECT handshake to the proxy, then TLS to the site curl -v -x http://USER:[email protected]:3128 https://example.com 2>&1 \ | grep -Ei 'CONNECT|Connection established|SSL connection|Proxy-Auth' # You'll see, in order: # > CONNECT example.com:443 HTTP/1.1 (client asks for a tunnel) # < HTTP/1.1 200 Connection established (proxy opened the tunnel) # * SSL connection using TLSv1.3 ... (TLS is end-to-end, past proxy) # Contrast: plain HTTP needs no tunnel; the proxy relays the request itself: curl -v -x http://USER:[email protected]:3128 http://example.com 2>&1 \ | grep -Ei 'GET http|absolute'
Questions, answered
What does the HTTP CONNECT method do?
It asks a proxy to open a raw TCP tunnel to a destination host and port, rather than fetching a resource. Once the proxy replies 200 Connection Established, the client tunnels its own TLS handshake and encrypted data straight to the destination, and the proxy just relays the opaque bytes. It is how HTTPS works through an HTTP proxy.
Can the proxy read my HTTPS traffic during a CONNECT tunnel?
No. After the tunnel opens, TLS is negotiated end-to-end between your client and the destination server, so the proxy sees only encrypted bytes. It can see the destination hostname and port from the CONNECT line and TLS SNI, but not the contents — unless it performs TLS interception with a certificate your device trusts.
Why do proxies restrict CONNECT to port 443?
Because CONNECT opens an arbitrary TCP tunnel, an unrestricted proxy could relay any protocol to any port and become an open relay for abuse. Limiting CONNECT to 443 (and sometimes a short allowlist) confines it to normal HTTPS while preventing the proxy from being used to tunnel unrelated services.
An HTTP proxy that tunnels HTTPS
s4m's authenticated HTTP proxy on port 3128 handles CONNECT so HTTPS stays end-to-end encrypted, alongside SOCKS5 on 1080. Metered pay-as-you-go, anonymous accounts, crypto accepted.
People found this page by searching for
- the HTTP CONNECT method explained
- how to configure ip address
- ip address step by step
- Puppeteer proxy setup with authentication
- socks5 proxy step by step
- openvpn for windows
- proxy for scraping explained
- how to set up WireGuard VPN
- what is http proxy
- proxy authentication
- proxy setup by country
- datacenter vs residential vs mobile proxies
- wireguard explained
- proxy setup settings
- proxy setup
Real search phrases this page answers — the linked ones open the page that covers them in depth.