No no, I read and understood correctly.
As I made same experience.

openssl fails when not pointed to common-ca
openssl succeeds when pointed to common-ca

cmcli fails when not pointed to common-ca
cmcli fails also even when pointed to common-ca

So that means we have all needed certs aboard, but mabe they are not used or ... ?
At least Nokia and Google changed their cert paths in the past.

And the proxy acts as a proxy? Or initiates a completely new connection to supl? In first case it would not work afaik as ssl/cert communication is just forwarded?