diff --git a/Network/HTTP/Client/TLS.hs b/Network/HTTP/Client/TLS.hs
--- a/Network/HTTP/Client/TLS.hs
+++ b/Network/HTTP/Client/TLS.hs
@@ -14,12 +14,14 @@
 import qualified Network.Connection as NC
 import Network.Socket (HostAddress)
 import qualified Network.TLS as TLS
+import qualified Data.ByteString as S
 
 mkManagerSettings :: NC.TLSSettings
                   -> Maybe NC.SockSettings
                   -> ManagerSettings
 mkManagerSettings tls sock = defaultManagerSettings
     { managerTlsConnection = getTlsConnection (Just tls) sock
+    , managerTlsProxyConnection = getTlsProxyConnection tls sock
     , managerRawConnection =
         case sock of
             Nothing -> managerRawConnection defaultManagerSettings
@@ -72,11 +74,36 @@
             , NC.connectionUseSocks = sock
             }
         convertConnection conn
-  where
-    convertConnection conn = makeConnection
-        (NC.connectionGetChunk conn)
-        (NC.connectionPut conn)
-        -- Closing an SSL connection gracefully involves writing/reading
-        -- on the socket.  But when this is called the socket might be
-        -- already closed, and we get a @ResourceVanished@.
-        (NC.connectionClose conn `Control.Exception.catch` \(_ :: IOException) -> return ())
+
+getTlsProxyConnection
+    :: NC.TLSSettings
+    -> Maybe NC.SockSettings
+    -> IO (S.ByteString -> (Connection -> IO ()) -> Maybe HostAddress -> String -> Int -> IO Connection)
+getTlsProxyConnection tls sock = do
+    context <- NC.initConnectionContext
+    return $ \connstr checkConn _ha host port -> do
+        --error $ show (connstr, host, port)
+        conn <- NC.connectTo context NC.ConnectionParams
+            { NC.connectionHostname = host
+            , NC.connectionPort = fromIntegral port
+            , NC.connectionUseSecure = Nothing
+            , NC.connectionUseSocks = sock
+            }
+
+        NC.connectionPut conn connstr
+        conn' <- convertConnection conn
+
+        checkConn conn'
+
+        NC.connectionSetSecure context conn tls
+
+        return conn'
+
+convertConnection :: NC.Connection -> IO Connection
+convertConnection conn = makeConnection
+    (NC.connectionGetChunk conn)
+    (NC.connectionPut conn)
+    -- Closing an SSL connection gracefully involves writing/reading
+    -- on the socket.  But when this is called the socket might be
+    -- already closed, and we get a @ResourceVanished@.
+    (NC.connectionClose conn `Control.Exception.catch` \(_ :: IOException) -> return ())
diff --git a/http-client-tls.cabal b/http-client-tls.cabal
--- a/http-client-tls.cabal
+++ b/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.2.0.3
+version:             0.2.1
 synopsis:            http-client backend using the connection package and tls library
 description:         Intended for use by higher-level libraries, such as http-conduit.
 homepage:            https://github.com/snoyberg/http-client
@@ -16,10 +16,11 @@
   other-extensions:    ScopedTypeVariables
   build-depends:       base >= 4 && < 5
                      , data-default
-                     , http-client >= 0.2
+                     , http-client >= 0.2.2
                      , connection >= 0.1.3
                      , network
                      , tls >=1.1
+                     , bytestring
   default-language:    Haskell2010
 
 test-suite spec