A good write up here for ways to try to intercept IoT devices without any hardware/firmware job: https://robertheaton.com/2019/11/21/how-to-man-in-the-middle...

The only relevant thing to repeat here might be this

> if you can’t get access to your IOT device’s hardware in order to add a new root CA to it, your journey mostly ends here. Don’t lose hope though. Leave your setup running for a while and see if anything strange happens. When I attempted the above process on my baby’s crib, the device refused to trust Burp’s certificate and so refused to complete a TLS handshake with my laptop. But after a minute or two of repeated failures, the crib started sending out some of its system status data over plain, unencrypted HTTP!

The point of TLS is to prevent that... You'd be relying on implementation flaws if it were ever achieved.

Frankly I expect the days of being able to install our own trusted certificates are numbered on the few devices that do currently allow it.

For iot security reasons, namely trying to stop persistence of exploits, secure boot features on arm processors will become widely used. Think of it like TPM chips. This will make it much harder to “own your” device.