diff --git a/panda/src/downloader/httpChannel.cxx b/panda/src/downloader/httpChannel.cxx
index 0690bd9ac8..8c7347779a 100644
--- a/panda/src/downloader/httpChannel.cxx
+++ b/panda/src/downloader/httpChannel.cxx
@@ -1813,16 +1813,16 @@ begin_request(HTTPEnum::Method method, const DocumentSpec &url,
 
   // An https-style request means we'll need to establish an SSL
   // connection.
-  _want_ssl = (_request.get_url().get_scheme() == "https");
+  _want_ssl = _request.get_url().is_ssl();
 
   _proxy_tunnel = false;
   _proxy_serves_document = false;
 
   if (!_proxy.empty()) {
-    // If we're opening an SSL connection, or we ask for a direct
-    // connection of some kind, or if we have a SOCKS-style proxy,
-    // that demands a tunnel through the proxy to speak directly to
-    // the http server.
+    // If we're opening an SSL connection, or the user has explicitly
+    // asked for a direct connection of some kind, or if we have a
+    // SOCKS-style proxy; each of these demands a tunnel through the
+    // proxy to speak directly to the http server.
     _proxy_tunnel =
       (_want_ssl || _method == HTTPEnum::M_connect || _proxy.get_scheme() == "socks");
 
diff --git a/panda/src/downloader/urlSpec.I b/panda/src/downloader/urlSpec.I
index 3c5f7ab278..c47d7f076c 100644
--- a/panda/src/downloader/urlSpec.I
+++ b/panda/src/downloader/urlSpec.I
@@ -227,6 +227,28 @@ get_query() const {
   return _url.substr(_query_start);
 }
 
+////////////////////////////////////////////////////////////////////
+//     Function: URLSpec::is_ssl
+//       Access: Published
+//  Description: Returns true if the URL's scheme specifies an
+//               SSL-secured protocol such as https, or false
+//               otherwise.
+////////////////////////////////////////////////////////////////////
+INLINE bool URLSpec::
+is_ssl() const {
+  if (has_scheme() && _scheme_end > 0) {
+    // If we have a scheme specification, assume it is SSL-secured if
+    // it ends in "s", except for the special case of "socks".
+    if (_url.substr(0, _scheme_end) == "socks") {
+      return false;
+    }
+    return (_url[_scheme_end - 1] == 's');
+  }
+
+  // If we have no scheme specification, it's not SSL-secured.
+  return false;
+}
+
 ////////////////////////////////////////////////////////////////////
 //     Function: URLSpec::get_url
 //       Access: Published
diff --git a/panda/src/downloader/urlSpec.h b/panda/src/downloader/urlSpec.h
index 566c7dfd43..ecbe29416e 100644
--- a/panda/src/downloader/urlSpec.h
+++ b/panda/src/downloader/urlSpec.h
@@ -60,6 +60,7 @@ PUBLISHED:
   string get_server_and_port() const;
   string get_path() const;
   INLINE string get_query() const;
+  INLINE bool is_ssl() const;
 
   INLINE const string &get_url() const;