<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
  <!-- default config that trusts nothing. Will always cause TLS errors -->
  <base-config>
    <trust-anchors>
    </trust-anchors>
  </base-config>
  <!-- debug override that trusts the system CA store. Connections will work as normal when the
       application is debuggable. -->
  <debug-overrides>
    <trust-anchors>
      <certificates src="system" />
    </trust-anchors>
  </debug-overrides>
</network-security-config>