Background: We have a site which works over HTTPS (HTTP not supported, we use HSTS). It's deployed in 3rd party cloud, which restricts our control and log abilities over server hardware. We cannot force using of client certificate authentication. So basically what we have is public HTTPS site with standard 2-factor authentication (login/pass + SMS), which can be accessed from desktop or mobile browser, and additional API on the same site from inside native mobile apps. Server software is based on .Net/IIS.
We're considering the following scenario - somehow user's computer/smartphone made to trust attacker's certificate, thus allowing classic MiM attack (so user is connected to proxy with trusted certificate, and proxy is connected to our server). One of the common (in some countries) scenarios for that is that Internet provider requires user to trust theirs self-signed certificate.
Leaving aside security on client-side (check certificate thumbprint etc) - is there any way for server (i.e. for our application) to understand that MiM attack is in place?
This is something like this question HTTPS - Can server see details of client side certificate?, but I'm looking not only for ways to detect such attack immediately (which would be good of course if possible), but also for ways which can help us detect such attack in long-run, having for example some historical records.