# Automating MQTT Engine/Transmission mTLS Setup

**URL:** <https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866>\
**Category:** Ignition\
**Tags:** ignition83\
**Created:** [June 5, 2026, 4:46pm UTC](https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866 "2026-06-05T16:46:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zaina.shaikh](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zaina.shaikh](https://forum.inductiveautomation.com/u/zaina.shaikh)\
**Post date:** [June 5, 2026, 4:46pm UTC](https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866/1 "2026-06-05T16:46:08Z")

</div>

Hi,

I’m trying to confirm if there is a supported way to automate mTLS configuration for Cirrus Link MQTT Engine/Transmission in Ignition? My goal is to automate **certificate provisioning** and **MQTT server setup** from a deployment script instead of manually uploading/configuring everything through the UI.

When I upload a CA cert, client cert, or private key through the MQTT Engine UI for example, Ignition creates config files under:

`data/config/resources/core/com.cirruslink.mqtt.engine.gateway/cert-file/`

The config files contains the encrypted structure generated by the Secrets Management system (`ciphertext`, `encrypted_key`, `iv`, `protected`, `tag`, etc).

#### **Questions**

1. Is there a supported API to create MQTT certificate resources? I didn't see any MQTT Engine/Transmission cert endpoints in /openapi documentation and wanted to confirm if these resources are available elsewhere.

2. Can the Secrets Management encryption API (`system.secrets.encrypt`) be used to generate the encrypted JSON for certificate and server resources? I'm unsure if the MQTT module will recognize resources created this way.

3. And is directly writing resource files under `data/config/resources/...` supported? If I generate the encrypted JSON myself and placed it in the correct folder structure, will the Gateway and the engine/transmission register it?

Any clarification or insights are appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![derek.delizo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/derek.delizo/32/84136_2.png) [@derek.delizo](https://forum.inductiveautomation.com/u/derek.delizo)\
**Post date:** [July 8, 2026, 8:59pm UTC](https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866/2 "2026-07-08T20:59:07Z")

</div>

Did you figure out how to solve this? I am trying to figure out a solution as well 🤔

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [July 8, 2026, 9:07pm UTC](https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866/3 "2026-07-08T21:07:25Z")

</div>

Creating secrets via `system.secrets` or the web API should yield something you can seed in the right place on disk. If you do this before the Ignition Gateway starts, it will get picked up when it starts. If you do it while running, you'll need to hit the route that requests a config scan.

---

<div class="post-metadata">

**Author:** ![derek.delizo](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/derek.delizo/32/84136_2.png) [@derek.delizo](https://forum.inductiveautomation.com/u/derek.delizo)\
**Post date:** [July 9, 2026, 2:52pm UTC](https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866/4 "2026-07-09T14:52:54Z")

</div>

I understand those are the constraints. I have some solutions I will be trying out.

---

<div class="post-metadata">

**Author:** ![zaina.shaikh](https://avatars.discourse-cdn.com/v4/letter/z/c89c15/32.png) [@zaina.shaikh](https://forum.inductiveautomation.com/u/zaina.shaikh)\
**Post date:** [July 10, 2026, 8:29pm UTC](https://forum.inductiveautomation.com/t/automating-mqtt-engine-transmission-mtls-setup/115866/5 "2026-07-10T20:29:32Z")

</div>

The solution I ended up implementing was to use Ignition's Secrets Management system with **referenced secrets** instead of uploading certificate files directly or using the web API.

Rather than trying to recreate the encrypted resource format generated by Secrets Management (`ciphertext`, `encrypted_key`, `iv`, `protected`, `tag`, etc.), I stored the certificates in a Secrets Provider and configured the MQTT certificate resources to reference those secrets.

The certificate resource uses a structure like this:

```python
"data": {
      "providerName": "provider-name",
      "secretName": "cert-secret-name"
    },
    "type": "Referenced"

```

By using referenced secrets, I don't have to generate or manage the encrypted JSON format. The MQTT Engine/Transmission modules resolve the certificate through the configured Secrets Provider, which was much easier to automate.