what was the value of the Proxy-Authorization? I got the following error with Squid proxy. "Unsupported or unconfigured/inactive proxy-auth scheme" and "Bad characters in authorization header 'Basic ****". Thanks.

Looking at: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authorization probably you need to add the type? Most likely it's something like: "Basic YTpi"

                  headers_to_add:
                    - header:
                        key: Proxy-Authorization
                        value: "Basic YTpi"

Looking at: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Proxy-Authorization probably you need to add the type? Most likely it's something like: "Basic YTpi"

                  headers_to_add:
                    - header:
                        key: Proxy-Authorization
                        value: "Basic YTpi"

That's right. Fixed with "user:password" as credentials.

I tried with "Basic YTpi" and got the error like this "Bad characters in authorization header 'Basic YTpi". And I have another question, is it possible to have a dynamic hostname?

I tried with "Basic YTpi" and got the error like this "Bad characters in authorization header 'Basic YTpi". And I have another question, is it possible to have a dynamic hostname?

You should check your upstream proxy for what authentication type it support.

For dynamic hostname, I don't know.

I tried with "Basic YTpi" and got the error like this "Bad characters in authorization header 'Basic YTpi". And I have another question, is it possible to have a dynamic hostname?

@rocky0001 did you manage to have a dynamic hostname solution ?

no.

live example with squid as L2 TLS proxy at https://github.com/scrocquesel/envoy_examples/tree/main/tls_origination_via_tls_l2_proxy

Thanks to envoyproxy/envoy#19612, the sample now allows for dynamic hostname solution. Setting domain matcher to "*" will let envoy proxy any destination to the L2 proxy.