TLS (SSL)

When a site address starts with https://, the program and the site agree on keys using the TLS protocol and then exchange encrypted data. The old name SSL is still used out of habit.

Encryption is preserved when working through a proxy. A regular HTTP proxy opens a tunnel to such sites using the CONNECT method and sees only the site name and the amount of data, not the contents of the pages.

The site name is sent at the start of the connection in the SNI field. This is how the proxy and the network learn which site the request is going to.

A certificate error while working through a proxy is a reason to stop and check your settings: a properly working proxy does not substitute site certificates.

The TLS handshake step by step

The program opens a connection and sends a ClientHello message: supported protocol versions, cipher suites, the site name and other extensions. The server answers with ServerHello and its certificate, both sides compute shared keys, and only then does encrypted data begin. In TLS 1.3 this takes one round trip, in TLS 1.2 two.

Through an HTTP proxy the handshake starts after the CONNECT tunnel is open, and every round trip travels the whole path via the exit address. That is one reason why the first request through a proxy takes longer than the next ones in the same connection.

The proxy does not change your TLS fingerprint

The set of versions, ciphers and extensions in ClientHello forms a TLS fingerprint, by which a site can tell a browser from a script. The tunnel passes ClientHello unchanged, so the site sees the fingerprint of your program, not of the proxy. Changing the IP does not change it.

How to check the connection and typical mistakes

Run curl -v https://example.com: the output shows the TLS version, the cipher and the certificate details, including who issued it and when it expires. The command openssl s_client -connect example.com:443 -servername example.com shows the whole certificate chain.

• The -k or --insecure flag in curl turns the check off and hides the problem instead of solving it.
• If your antivirus is named as the issuer of the certificate, it inspects HTTPS on its own, and the proxy has nothing to do with it.
• An expired certificate on the site itself gives the same error with and without a proxy.

Other causes are collected on the certificate errors page.