Many of these apply to using a LE or Commercial CA cert as well, and your program will need to be programmed to check certificates against the OS's store or its own either way.
That isn't how the APIs are structured.
If you're using an installed CA, you can just ask the OS to get a file over HTTPS and it will either throw an exception or it will succeed. If you want to use a custom CA it is more involved because you have to take over various parts of the process, to add logic which would check the CA the other side's certificate is attempting to use then drop the connection if it is invalid/unknown.
To get specific, in C# you can just use the WebClient Class to download files over HTTPS using a known (to the OS) CA and certificate signed by that CA. To implement custom certificate or CA verification you cannot use WebClient and instead have to utilise something like an x509 certificate validator callback on a WebRequest. Not rocket science but more involved.
Also, please don't use serial numbers for verification, wtf.
You're talking about using a custom CA for HTTPS or code signing. If you want to assure that only your company's custom CA get utilised in this process, and not some other CA then you'll need some way of verifying who the CA is in your software.
There's tons of things you could check to verify the custom CA is your CA, including serial number, thumbnail, and various other metadata. You cannot just allow any CA or certificate as a "bad guy" could just create their own.
Where do you get this number?
Wages. Two members of staff, sitting in a room planning this out. Let's say it only takes an hour, it could easily be $50, and that doesn't include benefits and other costs. This is a meeting which could be avoided by just buying a certificate and simplifying the workflow.
Most companies should use dedicated HSMs for storing and generating these keys...it takes maybe 15 minutes at most.
And what's the wage cost of setting that up? Likely more than a certificate from a standard CA.
Use a third party library for this, it's called certificate pinning.
Actually it isn't. Certificate pinning requires you to validate the certificate then store that certificate's unique info (e.g. serial) for a set period of time as the "known good" certificate for a given host. What you're proposing is quite different, using a self-signed certificate that cannot be validated through normal means and requires you to manually validate the certificate using logic within the software, install a custom CA, or similar.