MQTT GUIDE
3 min readMQTT over TLS/SSL
MQTT over TLS (often written MQTTS) wraps the MQTT connection in a TLS-encrypted channel, so credentials and payloads can’t be read or tampered with on the wire. It runs on port 8883 by default, versus 1883 for plaintext MQTT. TLS can also authenticate the client with a certificate (mutual TLS).
Plain MQTT on port 1883 sends everything — including passwords — as clear text, which is unacceptable across an untrusted network. MQTT over TLS (MQTTS) fixes that by running the same MQTT protocol inside an encrypted TLS channel. It’s the first of the three layers of MQTT security.
How MQTT over TLS works
Before any MQTT packet is sent, the client and broker perform a TLS handshake: the broker presents its certificate,
the two negotiate keys, and an encrypted channel is established. The CONNECT and
every message after it then travel inside that channel, unreadable to anyone on the path. Secure MQTT listens on
8883 by default.
One-way vs mutual TLS
With mutual TLS, the client’s certificate is what identifies it to the broker — see client certificate authentication.
TLS in TBMQ
TBMQ exposes TLS listeners for MQTT on port 8883 and for secure WebSocket (WSS) on 8085. Both are provided but ship disabled until you configure a server certificate. See the
MQTTS setup guide and
listener configuration for details.
Frequently asked questions
What port does MQTT over TLS use?
Port 8883 by default for MQTT over TLS (MQTTS), versus 1883 for plaintext MQTT. Over WebSocket, secure WSS commonly uses 8084 or 8085 depending on the broker — TBMQ uses 8085 for WSS and 8084 for plain WS.
What is the difference between one-way and mutual TLS?
In one-way TLS the broker presents a certificate so the client can verify it and encrypt the channel; the client still authenticates separately (e.g. with a password). In mutual TLS (mTLS) the client also presents a certificate, so the handshake authenticates both ends at once.
Does TLS replace authentication?
Only if you use mutual TLS with client certificates. Plain (one-way) TLS just encrypts the channel and proves the broker’s identity — you still need an authentication method such as username/password or a token to identify the client.
Is MQTTS a different protocol?
No. MQTTS is just MQTT running inside a TLS connection — the same MQTT packets, wrapped in an encrypted transport. The broker terminates TLS and then speaks ordinary MQTT underneath.
Does TLS add much overhead to MQTT?
Mostly a one-time cost at connection setup for the handshake. Because MQTT keeps one long-lived connection open, that cost is spread across every message that follows, and per-message encryption overhead is small.
Run it yourself
TBMQ is a free, open-source MQTT broker built to scale. Spin it up in minutes or try the live demo — no install required.