A customer whose company has severely locked down outbound access asked our CTO why we don’t support forward proxies. His only alternative is an outbound-only firewall exception request (which could take days or even weeks before it’s granted and implemented by their network admins).
Fair question. And if we have to answer it with the same fairness, it means separating two things the industry insists on (confusingly) calling by the same name.
A CONNECT tunnel (or its SOCKS5 equivalent) relays TCP bytes it cannot read. Your TLS handshake happens with the real server, end-to-end. All this “proxy” learns is a destination, a port, and some byte counts.
An intercepting proxy, sold to you as SSL/TLS inspection (aka “break and inspect”, ring any bells?) terminates your session, decrypts it, and opens a second one onward using a certificate your endpoints were configured (read: forced) to trust. That is a man-in-the-middle device with a support contract, and one compromise exposes every session that goes through it.
The distinction is not academic for us. The Syncplify Server!-R2FS! pair, and all components of SFTP.cloud SaaS guarantee hybrid post-quantum cipher-suites between all of their control plane components, and that guarantee can only be true when it can be established and verified end-to-end.
What these SSL/TLS intercepting proxies leave you with is a PQC connection to the middle-man, and an Agatha Christie-sized mystery beyond it.
We use mutual TLS (aka mTLS) with pinned certificates, which cannot survive interception by design, so the handshake fails at connect time. There is no silent downgrade path, and we will not ship a “skip verification” flag, because there is no moment when using one would be safe.
So, the only fair answer is: proxy traversal via CONNECT and SOCKS5 is on our roadmap, we’ll do it. Support for TLS-intercepting proxies is and always will be explicitly unsupported.
Proxying was never the problem. Interception is. Yes, even the type that a trillion dollars worth of marketing convinced you that “it’s for your own safety”: that’s how two out of three of the US’ major Telcos were hacked just last year. Not on our watch.