HTTPS Proxy

HTTPS proxies work in various ways to enhance your security and privacy online. You might assume that an HTTPS proxy functions exactly as a standard HTTP proxy, but several critical differences exist.

Because HTTPS implements encryption, it prevents any middle-man from listening in on the connection. Therefore, by design, HTTPS does not inherently play nicely with regular proxies. While the process may seem identical to an end-user, your browser must jump through some hoops to establish a secure proxy connection.

The first step in the process involves contacting the server over a designated TCP port. These port numbers may seem arbitrary, and to some extent, they are, although a server administrator may map out specific ports for particular uses. Additionally, certain ports are standard, such as port 23 for POP3 mail and port 80 for normal web browsing.

Next, the security handshake process starts. Handshaking typically utilizes two standard encryption schemes— Transport Layer Security (TLS) or the older Secure Sockets Layer (SSL). The idea behind these standards is to establish a “trust chain” where each link the messaging route is identified and verified.

These encryption methods exclude any third parties from eavesdropping on the communication between the client and server. Thus, the handshake process will usually fail against a proxied connection.

An HTTPS proxy completes the handshake process using various methods, such as passive exclusion, authoritative inclusion, or dynamic.

For passive exclusion, a proxy will remove itself from the chain of trust entirely by relaying all handshake messages directly to the client, as-is. This method is not as secure because all data associated with the handshake will not benefit from the proxy’s encryption layer.

Authoritative inclusion is available when the proxy has SSL or TLS credentials and can act as a secure secondary server. This kind of HTTPS proxy establishes a security sub-layer between itself and the client. This method provides more protection during the handshake process.

As you might imagine, a dynamic HTTPS proxy can perform either of these methods depending on the situation. Dynamic HTTPS proxies are usually the preferred option since they offer the most compatibility with various servers.