Comment by p_l

In similar philosophy, in a middlebox that wanted to decrypt the flows, I simply put TLS1.3 inside HTTPS CONNECT inside TLS1.2 stream.

Horrible, but it was easier than updating the middlebox...