I should also add for clarification that if going the Squid SSL Bump route, the VPS VM should only be hosting HAProxy using a Layer 4 TCP VIP and nothing else.

I should also add for clarification that if going the Squid SSL Bump route, the VPS VM should only be hosting HAProxy using a Layer 4 TCP VIP and nothing else. HAproxy should be routing the Squid Intercept to a private home in the region of the VPS provider and outside of Iran. Using Squid from a VPS directly nearly guarantees one will experience non-stop Captchas. Iranian HTTPS Client with cert installed -> HAProxy Layer 4 TCP listener on a VPS VM -> Squid SSL Bump running on a home router at someones house or business. Also important is to not do any of this from a cell phone.