I am working on a small M2M project (a few hundred nodes connected to a single cloud server), and want to use client certificate authentication, with each client getting its own unique cert at manufacture time. During development we have been using a self-signed .crt and .key to generate the client certificates, and all has been going well. We can issue and revoke certs as needed and our cloud service does the right thing with regard to refusing the connection if the client's cert is invalid or revoked.
Now we're getting closer to production time, and I wonder if this is a safe-enough approach, or whether there is some value in buying a PKI package from a "real" CA. The client nodes will be distributed around the world and will be connecting via regular Internet connections (no VPN, probably plenty of NAT'ted connections), if that makes any difference.