How should I configure TLS safely with self-signed certificates?

When using self-signed certificates, WithAllowSelfSignedCertificates(true) alone is not enough. Also set WithPinnedPublicKey(...) or WithPinnedPublicKeyFromFile(...) to pin the expected server public key.

This prevents an “accept any self-signed certificate” setup. Even in development, pinning is useful to reduce impersonation risk.