You don’t need to MitM. Squid can use SNI to allow whitelisted hosts, for now at least.