Are you sure that would work? In the absence of application URL rewrite, the OP effectively needs to perform a man-in-the-middle attack on HTTPS. Locast using a wildcard cert on lax.locastnet.org gets him half there, but the Host: issue cannot be overcome if enforced by the lax CDN.
The crazy approach is redirecting all *.locastnet.org traffic to your own web server/proxy/etc and doing a 302 redirect to lax.locastnet.org. That requires having a valid locastnet.org certificate. While mostly impossible in the wild (state-sponsored actors excluded), somebody owning the originating server can self-sign a fake cert and then provide the root-CA to their OS so that applications trust it. Add your self-signed cert to your Linux cert trust repository (and rebuild the links). If you run channels in the provided container, must rebuild the container.
The cleaner method is adding locast as a custom source. This is not trivial, but neither is the prior method. The main challenge is channels effectively wants static M3U playlist references. Because locast enforces concurrent limits, you must resolve the channel to M3U playback URL in real-time to avoid hitting the limit. There are a number of github projects converting locast to m3u streams, but the recent login-change has upset the apple cart.
Am guessing that due to the current legal action, locast is working very hard to drastically reduce out-of-region access. That is the winning legal angle for the broadcasters. If locast provides streams to out-of-region folks, they do something that broadcast could not do.