The connection parameters including encryption parameters and certificate from the origin.
There are a lot of weird rules in WebPKI you may miss, this is beyond a general purpose TLS library.
Enforcing Certificate Transparency rules or CAA records, is the proxy doing this?
Which browser enforces CAA?
it's a certificate misissuance, but AFAIK it's not up to the browser.