In TLS 1.2, the master secret, which is used for deriving keys, is derived from the pre-master secret and some additional data. With RSA key exchange, the TLS middlebox can simply act as the client and send the pre-master secret that was derived to the remote server. With Diffie-Hellman key exchange, the TLS middlebox sends non-prime parameters (which are usually insecure) based on the server's key exchange parameters such that the computation of the pre-master secret is the same. As Z.T. mentioned, this is described in the Triple Handshake paper.
In TLS 1.3, the keys are derived from the master secret and a hash of the handshake using HKDF. Because HKDF is a PRF (a pseudo-random function family), it is functionally impossible to generate the same set of keys when the handshake hashes are different (which they must be if the TLS middlebox and the server present different certificates), even if the keying material is the same.
This was done intentionally for two reasons:
- This makes it much harder to conduct any sort of attack on TLS, since the entire handshake, as well as the actual key exchange, influence the derived keys. It's no longer possible to specifically craft keying material to intentionally derive the same set of traffic keys, which has been used in previous attacks.
- Many folks involved in TLS do not like middleboxes, since they rightly see them as an intentional attack on the end-to-end security of the protocol, and this makes them more difficult to implement.