diff --git a/config/default.yml b/config/default.yml
index 45c5a67..a67337b 100644
--- a/config/default.yml
+++ b/config/default.yml
@@ -37,6 +37,8 @@ proxy:
 pac:
   # PAC server listen port.
   port: 55155
+  # Whether or not to tunnel SSL traffic.
+  tunnelSsl: false
 
 
 # Plugin settings below.
diff --git a/lib/pac.js b/lib/pac.js
index 3e47626..6357570 100644
--- a/lib/pac.js
+++ b/lib/pac.js
@@ -5,6 +5,18 @@ var util = require('util');
 var http = require('http');
 var log = require('./log');
 
+var PAC_TUNNEL_HTTPS = 'function FindProxyForURL(url, host) {\n' +
+                     '  return "HTTPS %s:%d";\n' +
+                     '}\n';
+
+var PAC_NO_TUNNEL = 'function FindProxyForURL(url, host) {\n' +
+                       '  if (url.substring(0, 6) == "https:") {\n' +
+                       '    return "DIRECT";\n' +
+                       '  } else {\n' +
+                       '    return "HTTPS %s:%d";\n' +
+                       '  }\n' +
+                       '}\n';
+
 // Default PAC server.
 var PacServer = function(options) {
 
@@ -16,9 +28,11 @@ var PacServer = function(options) {
   function handleRequest(request, response) {
 
     function createPacFile(host, port) {
-      var pac = 'function FindProxyForURL(url, host) {\n' +
-                '  return "HTTPS ' + host + ':' + port + '";\n}';
-      return pac;
+      if (options.pac.tunnelSsl) {
+        return util.format(PAC_TUNNEL_HTTPS, host, port);
+      } else {
+        return util.format(PAC_NO_TUNNEL, host, port);
+      }
     }
 
     var httpOpts = {