diff --git a/Network/HTTP/Client/Manager.hs b/Network/HTTP/Client/Manager.hs
--- a/Network/HTTP/Client/Manager.hs
+++ b/Network/HTTP/Client/Manager.hs
@@ -43,8 +43,10 @@
 import Data.Maybe (mapMaybe)
 import System.IO (Handle)
 import System.Mem.Weak (Weak, deRefWeak)
+import Network.HTTP.Types (status200)
 import Network.HTTP.Client.Types
 import Network.HTTP.Client.Connection
+import Network.HTTP.Client.Headers (parseStatusHeaders)
 
 -- | Default value for @ManagerSettings@.
 --
@@ -54,6 +56,7 @@
     { managerConnCount = 10
     , managerRawConnection = return openSocketConnection
     , managerTlsConnection = return $ \_ _ _ -> throwIO TlsNotSupported
+    , managerTlsProxyConnection = return $ \_ _ _ _ _ -> throwIO TlsNotSupported
     , managerResponseTimeout = Just 5000000
     , managerRetryableException = \e ->
         case fromException e of
@@ -124,6 +127,7 @@
 newManager ms = do
     rawConnection <- managerRawConnection ms
     tlsConnection <- managerTlsConnection ms
+    tlsProxyConnection <- managerTlsProxyConnection ms
     mapRef <- I.newIORef (Just Map.empty)
     wmapRef <- I.mkWeakIORef mapRef $ closeManager' mapRef
     _ <- forkIO $ reap wmapRef
@@ -133,6 +137,7 @@
             , mResponseTimeout = managerResponseTimeout ms
             , mRawConnection = rawConnection
             , mTlsConnection = tlsConnection
+            , mTlsProxyConnection = tlsProxyConnection
             , mRetryableException = managerRetryableException ms
             , mWrapIOException = managerWrapIOException ms
             }
@@ -327,11 +332,25 @@
     h = host req
     (useProxy, connhost, connport) = getConnDest req
     (connaddr, connKeyHost) =
-        case (hostAddress req, useProxy{-, socksProxy req-}) of
-            (Just ha, False{-, Nothing-}) -> (Just ha, HostAddress ha)
+        case (hostAddress req, useProxy) of
+            (Just ha, False) -> (Just ha, HostAddress ha)
             _ -> (Nothing, HostName $ T.pack connhost)
     go =
         case (secure req, useProxy) of
             (False, _) -> mRawConnection m
             (True, False) -> mTlsConnection m
-            -- FIXME (True, True) -> getSslProxyConn (checkCerts m h) (clientCertificates req) h (port req)
+            (True, True) ->
+                let ultHost = host req
+                    ultPort = port req
+                    connstr = S8.concat
+                        [ "CONNECT "
+                        , ultHost
+                        , ":"
+                        , S8.pack $ show ultPort
+                        , " HTTP/1.1\r\n\r\n"
+                        ]
+                    parse conn = do
+                        sh@(StatusHeaders status _ _) <- parseStatusHeaders conn
+                        unless (status == status200) $
+                            throwIO $ ProxyConnectException ultHost ultPort $ Left $ S8.pack $ show sh
+                 in mTlsProxyConnection m connstr parse
diff --git a/Network/HTTP/Client/Request.hs b/Network/HTTP/Client/Request.hs
--- a/Network/HTTP/Client/Request.hs
+++ b/Network/HTTP/Client/Request.hs
@@ -301,7 +301,8 @@
         | otherwise  = fromByteString "http://"
 
     requestHostname
-        | isJust (proxy req) = requestProtocol <> fromByteString hh
+        | isJust (proxy req) && not (secure req)
+            = requestProtocol <> fromByteString hh
         | otherwise          = mempty
 
     contentLengthHeader (Just contentLength') =
diff --git a/Network/HTTP/Client/Types.hs b/Network/HTTP/Client/Types.hs
--- a/Network/HTTP/Client/Types.hs
+++ b/Network/HTTP/Client/Types.hs
@@ -445,10 +445,15 @@
       -- ^ Create an insecure connection.
       --
       -- Since 0.1.0
+    -- FIXME in the future, combine managerTlsConnection and managerTlsProxyConnection
     , managerTlsConnection :: !(IO (Maybe NS.HostAddress -> String -> Int -> IO Connection))
       -- ^ Create a TLS connection. Default behavior: throw an exception that TLS is not supported.
       --
       -- Since 0.1.0
+    , managerTlsProxyConnection :: !(IO (S.ByteString -> (Connection -> IO ()) -> Maybe NS.HostAddress -> String -> Int -> IO Connection))
+      -- ^ Create a TLS proxy connection. Default behavior: throw an exception that TLS is not supported.
+      --
+      -- Since 0.2.2
     , managerResponseTimeout :: !(Maybe Int)
       -- ^ Default timeout (in microseconds) to be applied to requests which do
       -- not provide a timeout value.
@@ -486,6 +491,7 @@
     -- ^ Copied from 'managerResponseTimeout'
     , mRawConnection :: !(Maybe NS.HostAddress -> String -> Int -> IO Connection)
     , mTlsConnection :: !(Maybe NS.HostAddress -> String -> Int -> IO Connection)
+    , mTlsProxyConnection :: !(S.ByteString -> (Connection -> IO ()) -> Maybe NS.HostAddress -> String -> Int -> IO Connection)
     , mRetryableException :: !(SomeException -> Bool)
     , mWrapIOException :: !(forall a. IO a -> IO a)
     }
diff --git a/http-client.cabal b/http-client.cabal
--- a/http-client.cabal
+++ b/http-client.cabal
@@ -1,5 +1,5 @@
 name:                http-client
-version:             0.2.1.1
+version:             0.2.2
 synopsis:            An HTTP client engine, intended as a base layer for more user-friendly packages.
 description:         This codebase has been refactored from http-conduit.
 homepage:            https://github.com/snoyberg/http-client