Since the TLS connection will be terminated by the TLS proxy the authentication of the client via client certificates will be terminated there too. Since the TLS proxy does not have the private key of the client it will not be able to use the original certificate of the client when connecting with TLS to the final server.
The only way to pass the clients ...
I figured it out! The app was using a service called Approov, which was a third party service generating a new token every five minutes to prevent third party apps from accessing a protected ressource.
Took a while to get around it, but at least i learned something new.