Four steps. The tunnel lease lasts 10 minutes; grab a fresh one any time.
So the mock server's HTTPS is trusted by your OS/browser.
Download CA certA fresh, single-use config valid for 10 minutes. Only payment.rewards.brave.com-bound traffic goes through it.
Open the WireGuard app, import the .conf, and toggle it on. On phones you can scan it; on desktop use “Import tunnel(s) from file”.
Verifies DNS + tunnel + trusted cert all line up by reaching the mock through the tunnel.
Once activated, launch Brave — it now talks to this mock for subscription checks.