Broker-Client TLS Configuration

Broker-Client TLS Configuration

Configure Transport Layer Security (TLS) to ensure secure encrypted connection between the MQTT Broker and Clients.
You can connect theTLS client and broker either:
  • without a client certificate
  • with a client certificate.
For more information, see:
TIP: You must use the Privacy Enhanced Mail (PEM) format for certificates, certificate signing requests, and cryptographic keys. PEM files have the following extensions:
.pem
,
.key
,
.cer
,
.cert
,
.crt
.

TLS configuration without client certificate

Create an encrypted connection between the MQTT broker and the MQTT client without client certificate. Only a trusted CA certificate on the
FactoryTalk Optix
 client is required.

TLS configuration with client certificate

Create an encrypted connection between the MQTT broker and the MQTT client. A certificate is required to identify the client in the same way that the server certificate identifies the server. You can use certificate with username and password authentication. Client and server certificates are primarily used for authentication, and not for communication encryption.
TIP: When a client connects to a server over SSL/TLS, the server presents its SSL/TLS certificate to the client to prove its identity. The client verifies the authenticity of the server's certificate using a chain of trust, typically involving a trusted Certificate Authority (CA).
When the server identity is verified, the client and server establish a secure communication channel.
Provide Feedback
Have questions or feedback about this documentation? Please submit your feedback here.