Putting a manually generated cert on an embedded device is inherently insecure, unless you have complete physical control over the device.

And as mentioned in other comments, the revocation system doesn't really work, and reducing the validity time of certs reduces the risks there.

Unfortunately, there isn't really a good solution for many embedded and local network cases. I think ideally there would be an easy way to add a CA that is trusted for a specific domain, or local ip address, then the device can generate its own certs from a local ca. And/or add trust for a self-signed cert with a longer lifetime.

This is a bad definition of security, I think. But you could come up with variations here that would be good enough for most home network use cases. IMO, being able to control the certificate on the device is a crucial consumer right

Real question: What is the correct way to handle certs on embedded devices? I never thought about it before I read this comment.