I wanted to do the same with Phillips air purifier that uses AWS IoT. Unfortunately, it seems the engineers did their job: an eMudhra-signed certificate was not accepted and the AWS endpoint also uses mTLS, so I wasn't able to MITM the connection.

Their ESP also uses Secure Boot... I don't know that there isn't a way to break in, but I wasn't able to find one short of hardware notification :/