You basically want to break HTTPS.
There are a few ways this could work, but you are mostly relying on mistakes somewhere along the way. This is not an exhaustive list.
Device side problems
- Device might check the certificate is signed by a trusted CA (your MITM proxy can just generate a certificate).
- Device might check the certificate is signed by a trusted CA, but forgets to check CN (domain name) field, so any valid certificate works.
- Device allows you to install a custom CA (same as you do on your mobile device).
- sslstrip type attacks where device initiates connections on HTTP and relies on server to upgrade to HTTPS.
- Downgrade attacks to less/in-secure encryption.
- Modifying firmware to work with your certificates.
Target domain
- Private key may be available (probably not, but has been seen before, more common for self-signed certificates).
- Any compromised or misconfigured CA could be used to generate valid certificates for all domains (trusting all these CAs is the big problem of PKI).
- Target website or DNS attacks would allow attackers to generate valid certificates.
(Un)fortunately this is quite hard to do when properly configured. If it was easy, there wouldn't be much point to HTTPS.