Protocols & authentication · glossary

TLS passthrough

TLS passthrough is the behaviour of a proxy that relays an HTTPS connection without decrypting it: the client negotiates TLS with the destination through the tunnel, the destination's own certificate is presented, and the proxy sees only the server name and ciphertext. The opposite, TLS interception, requires the client to trust the proxy's certificate authority and lets the proxy read and modify content; commercial proxy networks do not do this.

1 min read Also called end-to-end TLS, no TLS interception Updated

Protocols All terms

How to verify#

  1. Open an HTTPS site through the proxy and inspect the certificate: the issuer must be a public certificate authority, not the proxy provider.
  2. Compare the certificate fingerprint with and without the proxy; they must match.
  3. Any "install our root certificate" step means interception.

Consequences#

  • The proxy cannot inject or read anything inside HTTPS; targeting must be expressed in the proxy credentials.
  • Certificate pinning in apps keeps working.
  • Content filtering by URL is impossible for the proxy; only host-level rules (blocked ports, blocked destinations) apply.

How it works at ProxShift#

ProxShift never terminates TLS: gateways and dedicated addresses tunnel HTTPS with CONNECT and relay SOCKS5 streams untouched. The proxy ports themselves do not speak TLS; the browser-to-site session already protects the content.

Ready when you are

See it on a real request.

Create an account, top up $20 and run the quickstart against your own target. Traffic you buy never expires.

Create an account Read the quickstart