MQTT Mutual TLS Handshake Fails

In this tutorial, you'll learn about MQTT Mutual TLS Handshake Fails. We cover key concepts, practical examples, and best practices.

The Problem

MQTT connection with mutual TLS (mTLS) authentication fails to establish.

Quick Fix

Wrong

WiFiClientSecure client;
client.setCACert(ca_cert);
client.connect("broker", 8883);
// No client certificate```

TLS handshake error: certificate_unknown (broker requested client cert, none provided).

### Right

```cpp
#include <WiFiClientSecure.h>

WiFiClientSecure espClient;

void setup() {
  Serial.begin(115200);
  WiFi.begin("SSID", "password");

  // mTLS: set both CA and client certs
  espClient.setCACert(ca_cert);
  espClient.setCertificate(client_cert);
  espClient.setPrivateKey(client_key);
  espClient.setExpectedHostname("broker.example.com");

  if (espClient.connect("broker.example.com", 8883)) {
    Serial.println("mTLS established");
  }
}```

mTLS established (Client and server verified each other's certificates)

## Prevention

Mutual TLS requires both server and client to present certificates. The broker requests a client cert during handshake. Set all three: CA cert (verify server), client cert (present to server), and client key. Use setExpectedHostname() to prevent MITM. Port 8883 for MQTT over TLS. Some brokers use 8884 for mTLS-only.

DodaTech engineers apply these same patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro for production IoT reliability.

## FAQ

<details style="margin-bottom:12px;border:1px solid #e2e8f0;border-radius:10px;overflow:hidden"><summary style="cursor:pointer;padding:14px 18px;font-weight:600;font-size:1.05rem;background:#f8fafc;border-bottom:1px solid #e2e8f0;color:#1e293b">### mTLS vs one-way TLS?</summary><div style="padding:14px 18px;color:#475569;line-height:1.7;background:#fff"><p>One-way: client verifies server. mTLS: both verify each other. mTLS provides stronger authentication -- broker knows exactly which client is connecting.</p>
<h3 id="what-port">What port?</h3><p>8883 (standard MQTT over TLS). Some brokers use 8884 for mTLS-specific connections. Check broker config.</p>
<h3 id="does-mtls-work-on-esp32">Does mTLS work on ESP32?</h3><p>Yes. ESP32 WiFiClientSecure supports setCACert, setCertificate, and setPrivateKey natively. Also works on ESP8266 with BearSSL.</p>
</div></details>