SSL and Certificate Errors Through a Proxy

What the error means

When you open an HTTPS site through an HTTP proxy, the program asks the proxy to open a tunnel with the CONNECT method (RFC 9110). After that, the proxy only passes bytes along, and the encrypted connection is established between your program and the site. The certificate you see was sent by the site.

So certificate errors through a proxy have the same causes as without it: the clock on the device, programs that intercept HTTPS, the settings of the site itself. A separate case is errors when the program tries to speak TLS to the proxy where the proxy expects plain HTTP.

A handshake failure is a TLS protocol alert (RFC 8446): a party could not negotiate an acceptable set of security parameters. Most often the cause is an outdated TLS version or library.

Causes

• Wrong date and time on the device. Chrome shows ERR_CERT_DATE_INVALID: the certificate appears expired or not yet valid.
• HTTPS is intercepted by an antivirus or a corporate network. They substitute their own certificate; if it is not trusted, you get ERR_CERT_AUTHORITY_INVALID.
• The https:// scheme in the proxy line. The program tries to establish TLS with the proxy itself on a port where it expects HTTP, and gets ERR_SSL_PROTOCOL_ERROR or “wrong version number”.
• An outdated program or library. It does not support the TLS versions and ciphers the site requires: ERR_SSL_VERSION_OR_CIPHER_MISMATCH or handshake failure.
• A problem with the site's own certificate. The certificate has expired or was issued for a different domain: ERR_CERT_COMMON_NAME_INVALID.

How to fix it

1. Turn on automatic date and time on the device.
2. Check the proxy line: for port 823 it should start with http://, as in the Python requests guide. The site itself can still be https://.
3. Temporarily turn off HTTPS scanning in your antivirus or try a different network to rule out interception.
4. Update the browser, program or library you work through.
5. Do not turn off certificate verification in the program: that removes protection against substitution without eliminating the cause.
6. Open the site without the proxy: if the error is the same, the problem is in the site's certificate.

How to check that it works

Open any well-known HTTPS site and the My IP page through the same proxy. If they open without warnings, the connection through the proxy is fine, and the error comes from the specific site or program.

Two-minute diagnosis

First paste the line into the proxy checker. If the proxy works there, the cause is in your app or its settings. If not, test the line from a terminal:

curl -v -x "http://USERNAME:PASSWORD@gw.prokso.com:823" https://api.ipify.org

• A < HTTP/1.1 407 line right after CONNECT means the proxy answered. The name after the code, for example NO_USER, points to the cause.
• The proxy answered CONNECT with 200 and then another code arrived - the proxy works, and that answer came from the website.
• No answer at all, only a timeout - the connection never reached the proxy: check the host, port and network.

Setup guides where this error comes up

• Proxy setup in Go
• Proxy setup in Java
• Proxy setup in C# (.NET)
• Proxy setup in Guzzle (PHP)
• Proxy setup in Postman