I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC).

I would like to know how to configure each IoT node to generate a self-signed certificate and how can this element improve the overall system security.

This certificate will only be used during IoT device deployment and will be used to avoid possible ManInTheMiddle attacks. Is it really useful for this specific case?

I have multiple IoT devices that will be connected to a cloud based platform in order to control these devices (IoT node running baremetal arm SoC).

These IoT nodes would be deployed and, during configuration, they would create a secure communication channel with backend generating a synmmetric key (one symmetric key per node). Once this symmetric key is generated and secure channel is created, there should not be a problem.

In order to avoid MITM attacks during configuration I would like to understand the implication and risks of using Station-to-Station protocol (STS).

This requires certificates for authentication.

Before key exchange using Diffie-Hellman, both endpoints should force to authenticate, this implies generating certificates for both endpoints. For this specific scenario, the option of generating a certificate signed by a CA per IoT for a unique initial operation during IoT device configuration seems too expensive for the application (certificate management, pay for certificate loading services).

One alternative regarding certificate is the generation of a self-signed certificate per IoT device. This certificate will only be used during IoT device deployment, so is it really useful for this specific case?