The way certificates work is that a certificate is sent by the web site to your computer. Your browser reads the certificate, looking for the identity of the "signing certificate." It then validates the signature of the downloaded certificate was created by the signing certificate. If the signing certificate is signed by itself, it is called a trusted root certificate. But not any old trusted root certificate will do. The browser will only trust certificates it was configured to accept when you installed the browser. These specially trusted certificates make up your trusted root certificate store, and can be OS based (Windows has a Certificate Store used by Edge, IE and Chrome browsers), or browser based (Firefox comes with its own pre-installed list of trusted root authorities.)
The attacker would have to first inject a trusted root certificate into your OS's Trusted Root Certificate store or your browser's list of trusted authorities.
Trusted authorities aren't looked up dynamically from the web while browsing. The proxy would never handle the trusted certificates except as a part of the installation package; and if the installation package was modified by the proxy, the package's signature would fail and the OS should give you an "unsigned package" warning when you're installing it.