Embedded devices Authentication, Integrity and Confidentiality Embedded devices send messages to the server. The server occasionally sends messages to individual devices(Reboot, upgrade firmware etc)

After some research this is my ad-hoc solution:

1) Each devices gets a unique id(like MAC address) and a public/private key pair when first programmed at the factory. The server will have a copy of the unique id and the public key for each device.  

2) The server has a public certificate.

3) When the device wants to send a message: If it wants confidentiality it can encrypt the message using symmetric encryption and the key,salt etc will be encrypted with the servers public key. Then it can use it's private key to digitally sign the message which gives the message Authentication and Integrity. 

4) The same process could be reversed when the server wants to send a message to the client. 

5) Timestamps will be part of the message to resist replay attacks. The time needs to be fairly synchronized (within a minute of each other) for data collection purposes. 

Are there any flaws with doing it this way? The devices are fairly resource constrained so have to pick fast public key algorithms.
I do not see an immediate flow, but the public-key cryptography seems to be an overkill in your system with a single server. As long as the server keeps some keys of each device $D$, it may as well keep a single symmetric key $K_D$, and use a single authenticated encryption scheme $\Pi$ with key $K_D$, for instance, AES-GCM. This would simplify your system significantly, and you would not need certificates. You would not even need random number generator, except for the key generation.