ApsaraMQ for MQTT supports mutual authentication based on X.509 certificates. Server certificates authenticate the server to clients, and device certificates authenticate clients to the server. You can manage both types of certificates in the ApsaraMQ for MQTT console.
Notes
Only Platinum instances support mutual authentication. Basic Edition instances do not currently support this feature.
Background information
Client authenticates the server
Clients authenticate the ApsaraMQ for MQTT server by validating the server certificate. If validation succeeds, the client establishes a connection with the server. To enable this, purchase or issue a server certificate, host it in Certificate Management Service, and then restart the ApsaraMQ for MQTT service with the server certificate.
For more information, see Server certificate management.
Server authenticates the client
The ApsaraMQ for MQTT server authenticates a client by validating its device certificate. When a client requests a connection, it communicates with the server over TLS 1.2 and sends its device certificate. The server validates the device certificate against a registered CA certificate. If validation succeeds, the client connects to the server.