diff --git a/starttls/dialer.go b/starttls/dialer.go
index bd817ab..90bbc4b 100644
--- a/starttls/dialer.go
+++ b/starttls/dialer.go
@@ -2,8 +2,12 @@ package starttls
 
 import (
 	"crypto/tls"
+	"fmt"
 	"net"
+	"net/url"
 	"time"
+
+	"github.com/mwitkow/go-http-dialer"
 )
 
 type timeoutError struct{}
@@ -51,3 +55,19 @@ func dialWithDialer(dialer Dialer, timeout time.Duration, network, addr string,
 
 	return conn, nil
 }
+
+func wrapDialerWithProxy(dialer Dialer, connectProxy *url.URL, tlsConfig *tls.Config) (Dialer, error) {
+	dialerOpt := http_dialer.WithDialer(dialer.(*net.Dialer))
+	tlsOpt := http_dialer.WithTls(tlsConfig)
+	if connectProxy.User != nil {
+		password, ok := connectProxy.User.Password()
+		if !ok {
+			return nil, fmt.Errorf("proxy username without password not currently supported")
+		}
+		auth := http_dialer.WithProxyAuth(http_dialer.AuthBasic(connectProxy.User.Username(), password))
+		dialer = http_dialer.New(connectProxy, dialerOpt, tlsOpt, auth)
+	} else {
+		dialer = http_dialer.New(connectProxy, dialerOpt, tlsOpt)
+	}
+	return dialer, nil
+}
diff --git a/starttls/starttls.go b/starttls/starttls.go
index 0aa1067..cdcfe1f 100644
--- a/starttls/starttls.go
+++ b/starttls/starttls.go
@@ -30,8 +30,6 @@ import (
 	"github.com/square/certigo/starttls/ldap"
 	"github.com/square/certigo/starttls/mysql"
 	pq "github.com/square/certigo/starttls/psql"
-
-	http_dialer "github.com/mwitkow/go-http-dialer"
 )
 
 // Protocols are the names of supported protocols
@@ -142,10 +140,10 @@ func GetConnectionState(startTLSType, connectName, connectTo, identity, clientCe
 	}
 
 	if connectProxy != nil {
-		dialer = http_dialer.New(
-			connectProxy,
-			http_dialer.WithDialer(dialer.(*net.Dialer)),
-			http_dialer.WithTls(tlsConfig))
+		dialer, err = wrapDialerWithProxy(dialer, connectProxy, tlsConfig)
+		if err != nil {
+			return nil, nil, err
+		}
 	}
 
 	go func() {