HTTPS proxy
An HTTPS proxy is a proxy that handles encrypted sites; the term sometimes also means an encrypted connection to the proxy.
Updated · Prokso editorial team
The term is used in two senses. Most often it is a regular HTTP proxy that can open a tunnel to HTTPS sites using the CONNECT method. Almost all proxies work this way.
The second sense is a proxy that the program itself connects to over TLS. Then the leg between you and the proxy is encrypted too, including the username and password. Not all programs support such a connection.
In browser settings, an "HTTPS proxy" or "SSL proxy" field usually means the first: which proxy to use for sites with https://. You enter the same address and port as for HTTP.
Prokso supports HTTP, HTTPS and SOCKS5; HTTPS sites open through the HTTP port. See the HTTP proxies page for details.
The scheme in the proxy line describes the leg to the proxy
In curl, Python and many other tools, the scheme before the proxy address says how to connect to the proxy itself, not to the site. The line http://LOGIN:PASSWORD@gw.prokso.com:823 is correct for https:// sites too: the program opens a CONNECT tunnel, and the data inside stays encrypted.
If you write https://gw.prokso.com:823, the program will try to start TLS with the proxy. Prokso ports expect a regular HTTP connection to the proxy, so such a line ends with an SSL error even before the request reaches the site. Change the scheme back to http://.
A common mistake in Python requests
In the proxies dictionary the keys mean the scheme of the site, and the values mean the proxy. The correct form is {"http": "http://LOGIN:PASSWORD@gw.prokso.com:823", "https": "http://LOGIN:PASSWORD@gw.prokso.com:823"}. If the "https" key is missing, https:// sites open directly, past the proxy, and you see your own IP.
This mistake is easy to miss, because http:// sites still go through the proxy. Check the exit IP on an https:// address specifically. The same applies to environment variables: you need both http_proxy and https_proxy.
What travels in the open on the way to the proxy
With a regular HTTP connection to the proxy, the CONNECT line and the Proxy-Authorization header are sent unencrypted. The header holds the username and password in Base64, which is an encoding, not encryption. The contents of https:// sites are still protected by TLS between your program and the site.
If you do not want to send a password at all, use the IP whitelist: up to 5 addresses per plan, without a username. Command examples are in the curl guide, and certificate problems are covered on the certificate errors page.
FAQ
What should I enter in the browser's "HTTPS proxy" field?
The same address and port as for HTTP. The browser will open the tunnel to https:// sites itself.
Do I need a separate HTTPS proxy for secure sites?
No. A regular HTTP proxy works with HTTPS sites through a tunnel, and the data stays encrypted.
Related terms
Residential $1.59, mobile $2.50, datacenter $0.65 per GB
Sign up in a minute, get access right after payment.