My apology for the late reply. Yes, it is mandatory to use external SSL certificate even for testing environment. Otherwise, you cannot lo in to the app.
It depends on what you want to test. If you just want to verify communications or test from a windows platform it's not mandatory to use an external certificate. You can install the selfsigned certificate from the RestAPI server on the Windows device you are using for the Hotel Mobile App. If the url can open without errors the Hotel Mobile app should work too.
But if you want to test all devices you'll need an external SSL certificate because installing a self signed certificate on a iOS device is not so easy and a external SSL certificate is much easier.