Configure Mutual TLS (mTLS)
release/2.xMutual TLS allows the client to present its own certificate to the broker.
Transport Support
- TCP: Use
CocoaMQTTorCocoaMQTT5. - WSS (WebSockets):
CocoaMQTTWebSocketautomatically uses Apple'sURLSessionWebSocketTaskon modern OS versions (macOS 10.15+, iOS 13+, tvOS 13+, visionOS 1+). On older versions, it falls back to Starscream, which does not support client identities.
Configuration Methods
You can configure client identity using either PEM/DER or PKCS#12 formats before calling connect():
- PEM/DER:
certificateDataaccepts a DER certificate, a single PEM certificate, or a PEM bundle (leaf first, then intermediates).privateKeyDataaccepts RSA PKCS#1 (RSA PRIVATE KEY) or unencrypted RSA PKCS#8 (PRIVATE KEY). - PKCS#12: A password-protected identity container supported by Apple's
SecPKCS12Import.
Security Best Practices
- Do not ship unencrypted PEM private keys in your application bundle.
- Do not embed PKCS#12 files with their passwords in the bundle.
- Use secure provisioning, user input, or Keychain-backed storage for long-lived secrets.
Key Properties
tlsServerName: Use this when the connection host differs from the DNS name in the broker certificate.clientIdentity: Configures the client's identity (certificate and private key).trustedServerCertificatesandusesSystemTrustStore: Configure how the client validates the broker.