Blog | G5 Cyber Security

HTTPS & Proxies: Can a Proxy See Your Data?

G5 Cyber Security

TL;DR

No, a standard HTTP proxy cannot see the content of HTTPS traffic. However, it can see that you’re connecting to an HTTPS website and some basic connection information (like the domain name). More advanced proxies or those configured with SSL interception can decrypt and inspect the traffic, but this requires extra setup and often involves trust issues.

Understanding the Basics

Let’s break down what’s happening when you use a proxy server. A proxy acts as an intermediary between your computer and the internet. When you connect through a proxy:

  1. Your browser sends a request to the proxy server instead of directly to the website.
  2. The proxy server then forwards that request to the website on your behalf.
  3. The website sends its response back to the proxy, which then passes it on to you.

HTTP proxies work with unencrypted traffic (HTTP). HTTPS uses encryption.

Why HTTP Proxies Can’t See HTTPS Content

HTTPS (Hypertext Transfer Protocol Secure) encrypts the data exchanged between your browser and the website. This means it scrambles the information so that anyone intercepting it – including an HTTP proxy – can’t read it.

What an HTTP Proxy *Can* See

  1. Domain Name: The proxy server knows the website address you’re trying to reach (e.g., www.example.com). This is part of the request it forwards.
  2. IP Address: It sees your IP address and the destination website’s IP address.
  3. Timestamps: The proxy logs when connections are made.
  4. Protocol: It knows you’re using HTTPS (because of the port number, usually 443).

Can a Proxy See HTTPS if it’s Configured to?

Yes, but this is more complex. A proxy server can be configured for SSL interception (also known as man-in-the-middle or MITM) which allows it to decrypt and inspect HTTPS traffic.

  1. SSL Interception: The proxy generates its own certificate that pretends to be the website’s certificate.
  2. Trust Issues: Your browser needs to trust this fake certificate, which usually means installing a root certificate provided by the proxy server. This is common in corporate environments for security monitoring but poses risks if you’re using a public or untrusted proxy.
  3. Decrypting Traffic: With the trusted certificate, the proxy can decrypt the HTTPS traffic, inspect it, and then re-encrypt it before sending it to you.

Example of installing a root certificate (this is just an illustration; specific steps vary by OS/browser):

openssl req -x509 -newkey rsa:4096 -nodes -out proxy_cert.pem -days 365

Checking Your Proxy Settings

To see if you’re using a proxy, check your browser or operating system settings:

Exit mobile version