Skip to main content

TLS & mTLS

Enable MQTT over TLS on its own listener:

"tls": {
  "addr": ":8883",
  "cert": "/etc/xcon-mq/server.crt",
  "key": "/etc/xcon-mq/server.key",
  "client_ca": "/etc/xcon-mq/ca.crt",
  "require_client_cert": false
}
  • addr — the TLS bind (conventionally :8883); empty = off.
  • cert / key — the server certificate chain and key (PEM).
  • The listener negotiates TLS 1.2 or higher.

Client certificates & mTLS​

  • client_ca set, require_client_cert: false — client certificates are verified when presented but not required.
  • client_ca set, require_client_cert: true — every client must present a certificate signed by that CA (mTLS).

A presented certificate is passed to the auth chain; with the x509 provider its Common Name selects a builtin user, so the cert both authenticates and selects the ACL.

Scope: TLS applies only to this listener. The plain TCP and WebSocket listeners and the admin HTTP server are not TLS-terminated by this setting — front the admin server with a reverse proxy or bind it to loopback.