For an embedded industrial application, I want to use TLS to encrypt HTTP communication. I'd like to offer users easy to use options if there is no PKI readily available.
What are my choices here, to ensure best compatibility?
I thought about using TLS-PSK (users then would simply need to configure the PSK on both client and servir sides), but compatibility is a disaster. Most HTTP(S) clients (e.g. curl) or client libraries simply do not support TLS-PSK at all.
I also considered certificate pinning with server-side automatically generated self-signed certificates, so that no CA is required. Users would then only have to copy and import the certificate on the client side. The typical check of common name against the hostname would typically have to be disabled as well. Again, most HTTP client libraries don't really support this scenario.
Are there any other options available that I am missing?