Ok, so what's your alternative?
You're already assuming that the user of the firewall is already
misusing SSL. They need to blindly accept unsigned SSL certificates,
and changes to the certificates. Just about any security restrictions
you can apply can be done away with if the user is incompetant enough.
Some form of challenge response? If you can already perform a man in
the middle attack, than challenge response is just as vulnerable.
Just connect to the server when the client hits you, and pass them the
challenge you recieved. Use the credential yourself, and pass them a
failure. When they try again, connect them to the server.