Self signed for this use case is fine. you know and trust both ends of your connection, and no one else needs to know or trust either end of the connection.