RFC 3620:The TUNNEL Profile
RFC-Ref

certificate


Click on the red underlined text to get to the source

... endpoint machines may therefore negotiate TLS between them, passing certificates appropriate to the endpoints rather than the proxy ...


... or modifying the cleartext information exchanged, but only if TLS certificates are properly configured during the negotiation. The proxy ...



Google
Web
RFC-Ref