For testing I've stripped it down to just these 8 lines (in reality I need a %ul in the injected header, but the test fails even with a constant string). With the following squid.conf, the header is added both to CONNECT and non-https requests, but while in non-https requests the header has the correct value "Test User", in CONNECT requests the header has just a "-" as its value. # squid.conf http_access allow all request_header_add X-Authenticated-User "Test User" http_port 8080 cache_peer 10.55.20.18 parent 8081 0 no-query no-digest always_direct deny all never_direct allow all shutdown_lifetime 1 seconds debug_options ALL,1 11,2 28,3 55,3 Cheers. Libit P.S: I also tried with a different header name and/specifying an acl ("all") after the request_header_add (but that's indeed not necessary as per the documentation) -- View this message in context: http://squid-web-proxy-cache.1019090.n4.nabble.com/Empty-macros-in-request-header-add-for-SSL-connections-Squid-3-3-3-tp4659578p4662165.html Sent from the Squid - Users mailing list archive at Nabble.com.