(FYI - I'm the author of the doc you link to.. :-) ) There is not a requirement to use a full PKI infrastructure or public certs (like Digicert). The main requirement is that your leaf IoT devices trust the certificate that IoT Edge returns when your leaf devices attempt to connect. The easiest way to do this is to use a public CA (digicert, etc) or, in an enterprise environment that already has PKI infrastructure, which may already be trusted by devices in the enterprise. But neither of those are a requirement. The requirement is to get the leaf to trust the root cert from which the Edge cert is generated, which can be a self-signed root cert generated from openssl, etc (like our scripts do). The downside of that is that it's now up to you to both secure the private half of that cert to keep bad actors from getting it, but most importantly, it's up to you to get that cert(public) distributed out to, and trusted by, your leaf devices. Depending on the OS of our leaf devices, that may be easier (e.g. Windows group policy, linux scripts, etc) or much harder (e.g. embedded OS). But the key point there is that it's possible to just use self-signed certs, you are just then on the hook for getting the leaf devices to trust them by getting that self-signed root cert into the devices trusted root ca list (which is both OS and programming language dependent).
Also, there is no requirement to have an intermediate cert between the root cert and your device ca cert (our scripts just do this to show a 'typical' environment). However, the device ca cert itself is 'technically' an intermediate (it's a 'signing' cert).
