If your scale actually makes caching worth it you can run a local HTTPS mirror. If you don't control the endpoints to do that, you don't get to MiTM anything.

give the cache server a certificate?

SSL bumping