If you own the client and the proxy its still possible. Install a controlled root cert on the clients. On the proxy dynamically create & sign certs for each domain the client requests. Present these false certs to the clients connection. On the "north" end the proxy is now responsible for verifying the remote cert chains etc. Proxy has access to all the bytes, programmatic clients succeed in auth, human clients have a green check box in the browser. Totally doable today. I think some of the commercial appliances even do this for you.