[mosquitto-dev] tls / acl security discussion

[Leandro <ingrogger@xxxxxxxxx>]

Hi guys , I need to deploy a security diagram for my mqtt service.

I would like to share my thoughts about tls and acl.

First idea.
Using only server vs server and client certificate:
I think that it has no sense to use client certificate , since if some
grants physical access to the device storage , would have access to my
mosquitto server even if I server request clients certificate or not.

Second Idea.
Using only ca signed certificate (similar to https) I will have
encryption and in case someone grants my certificate I can limit it
access to an specific topic with acl.

Third idea:
To use some rate limit on the firewall so I can protect the service
against a dos.


Other ?? Any other idea about seurity would be pretiated,
Regards,
Leo.