Double-check the certificate that you downloaded. There should be a chain, but you don’t want the certificate issued for the domain itself. There would normally be a self-signed root certificate that is used to sign certificates generated for the domain visited. The certificate for the domain can change on virtually every request, but the signer should be consistent.
I’ve had to deal with this sort of proxy setup for almost a decade, but I no longer have a real world example to demonstrate with. The organization recently decided to stop doing this and transparently proxy HTTPS.