Michael, Send the "Proxy-Connection: keep-alive" header with HTTP CONNECT requests for compatibility with HTTP/1.0 proxies such as Squid. This is required for NTLM authentication. Webrev: http://cr.openjdk.java.net/~chegar/6973030/webrev.00/webrev/ Thanks, -Chris.