No generic TLS interception requirement
A conventional CONNECT proxy can relay the encrypted byte stream without decrypting the website's TLS content.
HTTPS proxy
Tunnel HTTPS connections through a compatible proxy.
With HTTPS CONNECT, a compatible client asks the proxy to open a tunnel to the destination. The end-to-end TLS session remains between the client and the destination.
Connection model
CONNECT creates the tunnel. TLS happens through it.
1
Client
Requests a CONNECT tunnel to the destination host and port.
2
Proxy
Creates the TCP path when the request is allowed.
3
TLS destination
The client negotiates its encrypted HTTPS session across that path.
Why people use it
HTTPS sites are common, so CONNECT support matters.
The proxy should not need to impersonate the destination or install interception certificates just to provide ordinary tunnelling.
Works only where supported
The application or system must know how to use an HTTP/HTTPS proxy and issue CONNECT for secure destinations.
Zenproxy keeps configuration visible
The app page can show selected location, proxy endpoint and connection state so users know which route is active.
Compare HTTPS with SOCKS5.
Choose based on what your application supports and what kind of connection you need.