# TLS passthrough

TLS passthrough is the behaviour of a proxy that relays an HTTPS connection without decrypting it: the client negotiates TLS with the destination through the tunnel, the destination's own certificate is presented, and the proxy sees only the server name and ciphertext. The opposite, TLS interception, requires the client to trust the proxy's certificate authority and lets the proxy read and modify content; commercial proxy networks do not do this.


## How to verify

1. Open an HTTPS site through the proxy and inspect the certificate: the issuer must be a public certificate authority, not the proxy provider.
2. Compare the certificate fingerprint with and without the proxy; they must match.
3. Any "install our root certificate" step means interception.


## Consequences

- The proxy cannot inject or read anything inside HTTPS; targeting must be expressed in the proxy credentials.
- Certificate pinning in apps keeps working.
- Content filtering by URL is impossible for the proxy; only host-level rules (blocked ports, blocked destinations) apply.


## How it works at ProxShift

ProxShift never terminates TLS: gateways and dedicated addresses tunnel HTTPS with CONNECT and relay SOCKS5 streams untouched. The proxy ports themselves do not speak TLS; the browser-to-site session already protects the content.

Source: https://proxshift.com/glossary/tls-passthrough