For testing against private RainMaker, which Claiming method should be configured on the device side? How are certificates generated?

Private RainMaker only supports Host Driven Claiming. On the device side, enable CONFIG_ESP_RMAKER_NO_CLAIM.

Certificates must be generated using the esp-rainmaker-admin-cli and flashed to the device fctry partition — one unique certificate per device.