- When is this Certificate needed to be generated? During production in FW load on the IoT device?
Each individual device should generate its own certificate during initial setup, to prevent any other party from observing the private key.
- Can I generate using a specific application those certificates? Does it have to be done by a certified authority?
This first part depends on what your deployment target is, but since the most likely target is some form of Linux, you're looking at OpenSSL. After the device generates its certificate, it wants to send what's known as a Certificate Signing Request (CSR) to your own issuing CA - this can be a completely self-signed chain (and not involve an external CA), but getting an intermediary issuing CA isn't difficult either (usually for things like subdomains).
- Once I´ve confirmed a IoT device is correctly signed by the CA and a secure channel is established, is there any additional need for this certificate?
You need the certificate every time you begin to authenticate/connect, after which (due to the way TLS works) it's exchanged for a symmetric key (that is, the certificate itself is no longer needed). However, there's nothing to automatically "delete on connect" these certificates that I'm aware of, especially because you usually need them because of the very real likelyhood of service interruptions (which would require you to reconnect).
- In case the previous question is afirmative, is there a Expiry Date of these certificates? And would this imply in any costs?
Certificates have an expiry period. Valid policy lengths depend on the issuer (whoever validates/signs the CSR), so if you're doing the issuing this can be whatever you want. There would be no costs other than the extra processing time/bandwidth, plus access to the signing server. Note that some microservice platforms do things like rotate certificates every week/day/hour.
You should also check the cloud platform for recommendation on IoT device setup, because this is going to be a really common topic. For example, this topic in the Azure IoT documentation goes over at least some of this.