That’s when you install squid and have it do the terminating TLS. They won’t pin the certs, too many corps do this already and not to mention certificate lifetime is in the realm of leaving a browser open for weeks.