MQTT over TLS (MQTTS) in IOT Protocols - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of MQTT client connection command with TLS

What is the output when running this command to connect an MQTT client over TLS to a broker with a valid CA certificate?

IOT Protocols

mosquitto_sub -h test.mosquitto.org -p 8883 --cafile /etc/ssl/certs/ca-certificates.crt -t 'test/topic'

A Connected to test.mosquitto.org with TLS, waiting for messages on 'test/topic'

B Error: Connection refused - no TLS support on port 8883

C Syntax error: unknown option '--cafile'

D Connection timed out: broker not reachable

💡 Hint

Check if the port 8883 is the standard port for MQTT over TLS and if the CA file is correctly specified.

The command uses mosquitto_sub to connect securely over TLS on port 8883 with a CA certificate file. If the broker supports TLS and the CA file is valid, it connects and subscribes successfully.

❓ Configuration

intermediate

Correct TLS configuration snippet for Mosquitto broker

Which configuration snippet correctly enables TLS on a Mosquitto broker listening on port 8883?

A

listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
require_certificate false

B

listener 1883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

C

listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
require_certificate true

D

listener 8883
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
allow_anonymous true

💡 Hint

TLS requires the broker to have server certificate and key. CA file is needed when requiring client certificates, which is optional but more secure.

Option C correctly sets the listener on port 8883 with all TLS files and requires client certificates, which is a secure TLS setup.

❓ Troubleshoot

advanced

Troubleshooting MQTT TLS connection failure

A client fails to connect to an MQTT broker over TLS with the error 'TLS handshake failed'. What is the most likely cause?

A The broker's TLS certificate is expired or invalid

B The broker is running without TLS support enabled

C The client did not specify the topic to subscribe to

D The client is using the wrong port number (e.g., 1883 instead of 8883)

💡 Hint

TLS handshake errors usually relate to certificate problems or mismatched TLS settings.

An expired or invalid certificate on the broker causes the TLS handshake to fail because the client cannot verify the broker's identity.

🔀 Workflow

advanced

Steps to enable MQTT over TLS on a new broker

What is the correct order of steps to enable MQTT over TLS on a new Mosquitto broker?

A 2,1,3,4

B 3,1,2,4

C 1,3,2,4

D 1,2,3,4

💡 Hint

Certificates must be created before configuring the broker to use them.

First generate CA, then server cert signed by CA, then configure broker, finally restart service to apply TLS.

✅ Best Practice

expert

Best practice for MQTT client certificate usage in MQTTS

Which practice is best for securing MQTT clients connecting over TLS with client certificates?

A Disable client certificate verification to avoid connection issues

B Use a unique client certificate per device and revoke compromised certificates promptly

C Use a single client certificate shared by all devices for simplicity

D Use self-signed certificates on clients without CA verification

💡 Hint

Security improves when each device has its own certificate and compromised ones can be revoked.

Unique client certificates per device allow fine-grained control and revocation, improving security in MQTTS.