Some mirrors already support HTTPS, but Debian doesn't advertise this. An incomplete, possibly out-of-date list is here: https://lists.debian.org/53B6150A.3000

Some mirrors already support HTTPS, but Debian doesn't advertise this. An incomplete, possibly out-of-date list is here: https://lists.debian.org/53B6150A.3000602@at.or.at https://lists.debian.org/53B6150A.3000602@at.or.at Besides that, https://deb.debian.org/ https://deb.debian.org/ provides HTTPS mirrors backed by CDNs. I don't know how to get http://debug.mirrors.debian.org/debian-debug/ http://debug.mirrors.debian.org/debian-debug/ over HTTPS though. :-(