# How to connect to MQTT over TLS with company certificates

**URL:** <https://forum.inductiveautomation.com/t/how-to-connect-to-mqtt-over-tls-with-company-certificates/72149>\
**Category:** 3rd Party Modules\
**Created:** [April 6, 2023, 2:02pm UTC](https://forum.inductiveautomation.com/t/how-to-connect-to-mqtt-over-tls-with-company-certificates/72149 "2023-04-06T14:02:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdelghani\_DJEDJIG](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/abdelghani_djedjig/32/45743_2.png) [@Abdelghani\_DJEDJIG](https://forum.inductiveautomation.com/u/Abdelghani_DJEDJIG)\
**Post date:** [April 6, 2023, 2:02pm UTC](https://forum.inductiveautomation.com/t/how-to-connect-to-mqtt-over-tls-with-company-certificates/72149/1 "2023-04-06T14:02:03Z")

</div>

Hello Team,

We are working on project at the company where we are trying to connect to MQTT Distributor (MQTT over TLS) installed in Ignition :

- The connection to MQTT (1883) is working good.
- The connection to MQTT over TLS (8883) is working only with MQTT Engine of the Ignition Gateway (Internally)
- The problem is trying to connect to MQTT over TLS/SSL with company certificates.

We have two questions :

- What are the required ports to open between device and Ignition Gateway to ensure this connection (MQTT over TLS/SSL) ? knowing that is secured at the company (it will be good to know if there is other ports to open in addition to 8883) ?
- From the client side (MQTT Transmission), what are the certificates required to ensure the connection with Ignition Gateway in MQTT over TLS ?

Thank you for your help 🙂

---

<div class="post-metadata">

**Author:** ![Adekunle\_Bakare](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@Adekunle\_Bakare](https://forum.inductiveautomation.com/u/Adekunle_Bakare)\
**Post date:** [March 18, 2024, 7:05pm UTC](https://forum.inductiveautomation.com/t/how-to-connect-to-mqtt-over-tls-with-company-certificates/72149/3 "2024-03-18T19:05:49Z")

</div>

Hi, were you able to figure out this problem?

---

<div class="post-metadata">

**Author:** ![Abdelghani\_DJEDJIG](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/abdelghani_djedjig/32/45743_2.png) [@Abdelghani\_DJEDJIG](https://forum.inductiveautomation.com/u/Abdelghani_DJEDJIG)\
**Post date:** [March 19, 2024, 11:53am UTC](https://forum.inductiveautomation.com/t/how-to-connect-to-mqtt-over-tls-with-company-certificates/72149/4 "2024-03-19T11:53:52Z")

</div>

Hello, yes the problem is solved 🙂

1. The MQTTS requires the port 8883 in two directions from the broker to client + TLS certificate.
2. The MQTT client needs only the client certificate.

---

<div class="post-metadata">

**Author:** ![Adekunle\_Bakare](https://avatars.discourse-cdn.com/v4/letter/a/e9bcb4/32.png) [@Adekunle\_Bakare](https://forum.inductiveautomation.com/u/Adekunle_Bakare)\
**Post date:** [March 19, 2024, 5:51pm UTC](https://forum.inductiveautomation.com/t/how-to-connect-to-mqtt-over-tls-with-company-certificates/72149/5 "2024-03-19T17:51:32Z")

</div>

Which of these certificate do you mean by the client certificate?

I was able to connect the engine and transmission to the distributor but I have been getting connection failed from the outside client and I have the port 8883 opened in two directions from the broker to the client and our Ignition is SSL enabled.

Do we need a separate certificate for the MQTT different from the one we used to enabled the ignition SSL?

When we enabled our SSL, I got a root cert, intermediate cert and server cert which I uploaded on Ignition to enabled the SSL. The client I am trying to connect to with is asking for CA cert and Client cert...which of these cert can be used for CA and Client.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/5/3/539709a2e99b965ea7190dad2d5aac12d9ed4535.png)