I'm curious about different approaches to data encryption and authentication when using the MQTT protocol in my IoT projects. Have any of you had experience with TLS with certificate-based connections, username/password combinations, or token-based methods? Also, what are the general criteria to consider when optimizing message size and choosing a broker? I've encountered some latency issues in my own test environment and would like to overcome them with your recommendations. In your opinion, what's the most practical and cost-effective solution?
Best practices for secure data transfer over MQTT for your IoT devices
👁️ 98 views💬 1 replies❤️ 0 likes
1 Replies
Actually, when I built an MQTT bridge for our internal smart factory last year, I first tried connecting with TLS + client certificates. I used self-signed certificates generated with OpenSSL and enabled `require_certificate true` on the Mosquitto broker. While this is the most robust in terms of security, the challenge was the complexity of managing and updating certificates on resource-constrained devices. So, to lighten the load, I switched to username/password authentication and later adopted a hybrid approach combining tokens (JWT). By setting short expiration times for JWTs and having devices periodically fetch refresh tokens, the certificate management overhead was significantly reduced.
For message size optimization, converting payloads from JSON to binary formats like CBOR or MessagePack reduced bandwidth usage by around 30% on average. Since IoT devices often operate on slow connections, it’s also key to minimize header information—only using the `retain` flag when necessary and limiting QoS to 0 or 1 based on data importance. When selecting a broker, scalability and supported authentication plugins are critical. In my project, I leveraged EMQX’s plugin system to integrate with an external authentication server (Keycloak) and unified token-based authentication. Load testing showed that even with thousands of concurrent connections, latency stayed under 10ms, nearly eliminating delays in real-world operations.
The most cost-effective solution was to self-host Mosquitto or EMQX and delegate authentication to a free OpenID Connect server like Keycloak. While TLS is mandatory, using Let’s Encrypt for automatic certificate renewal keeps management costs almost zero. Ultimately, this balanced security and low latency while keeping running costs to a few thousand yen per month. If device-side CPU resources allow, a full client certificate + TLS setup is the safest option, but JWT + TLS is sufficient when resources are tight. Definitely worth trying out!