There is an embedded device which should connect to the server over HTTPS and MQTTS. A server certificate is issued by a trusted CA (for example, Let's Encrypt). But there is a problem with server certificate verification on the client side because the device doesn't know about trusted CA's.
So I have a few options:
Put a DST Root CA X3 root certificate (LE root cert) into the device and check against it;
Make a self-signed root certificate and put it into the device;
Public key pinning.
The first approach doesn't work because the DST Root CA X3 will expire next year. Furthermore, Let's encrypt may change their root certificate at any time and we can't guarantee that newly issued certificates will be signed by the same one.
The second way makes my HTTPS server not trusted for other clients like web browsers.
What about using multiple certificates at the same time? Is it possible? If I'm not mistaken Nginx server supports it, but I'm not sure it works in the way I guess: if the first certificate (e.g. Let's Encrypt) verification fails a server would give a fallback certificate (e.g. self-signed) to the client. Even if so not all servers support this.
The third way is to put my server public key hash into the firmware. In this case I can use any CA in future (am I right?). The only thing I should be careful about is always using the same keys when generating CSR.
Which way is better? Or are there any other solutions for my problem?