It is still possible, it needs three things to work:
1) SNI indicators on the HTTPS handshake deliver the hostname to the DPI processor, be it on the connection Consumer => CF or CF => TPB.
2) Most likely the provider has a trusted CA... and CF => TPB connection does not support pinning.
3) Provider redirects to interceptor, which serves a "blocked" notice page, with a trusted HTTPS cert.
Alternative to 2 & 3 in case provider doesn't want to risk his CA: simply drop the connection by injecting a FIN packet once TPB is seen in the SNI headers.
1) SNI indicators on the HTTPS handshake deliver the hostname to the DPI processor, be it on the connection Consumer => CF or CF => TPB.
2) Most likely the provider has a trusted CA... and CF => TPB connection does not support pinning.
3) Provider redirects to interceptor, which serves a "blocked" notice page, with a trusted HTTPS cert.
Alternative to 2 & 3 in case provider doesn't want to risk his CA: simply drop the connection by injecting a FIN packet once TPB is seen in the SNI headers.