Hi Ireshet,
For Cloud, Clients(devices) will only need to trust the server root CA certificate. If it’s set up correctly then clients should always leverage the certificate chain and validate only against the root certificate. You can generate server root CA for your cloud instance and add it to truststore of all your devices.
Please check here to know how to generate a server root CA certificate for a cloud instance.
Kind regards,
Dasha from HiveMQ Team