The connection parameters including encryption parameters and certificate from the origin. There are a lot of weird rules in WebPKI you may miss, this is beyond a general purpose TLS library.

Enforcing Certificate Transparency rules or CAA records, is the proxy doing this?

Which browser enforces CAA?

it's a certificate misissuance, but AFAIK it's not up to the browser.