If the device is using HTTPS, you'd need a valid certificate for that hostname - that's exactly the attack HTTPS is designed to defend against. And if they're

If the device is using HTTPS, you'd need a valid certificate for that hostname - that's exactly the attack HTTPS is designed to defend against. And if they're using certificate pinning, it can't even be any certificate from a trusted authority, it has to be one particular authority or even that specific certificate that they use (they could very well be using an internal CA for this, as they control the other end of the connection).