If you control the client and you control the servers it needs to communicate with, then you should probably not be using the public CA system. Well yes if you

If you control the client and you control the servers it needs to communicate with, then you should probably not be using the public CA system. Well yes if your "embedded" device has a user-facing webbrowser you will need the public CA system, but then I'd wager if you shipped such a device and don't have ongoing updates you have much much bigger problems than an outdated set of root CAs. But there is zero reason for your mobile app communicating exclusively with your API endpoint to use the public CA system. You're paying for a less secure system with all the same hassles.