Only option is [ConnectCallback](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.socketshttphandler.connectcallback?view=net-9.0).
You can create SslStream, save certificates to HttpRequestMessage, and return that stream. When you return SslStream from ConnectCallback, SocketHttpHandler will skip it's own ssl connection establishment.