Global – October 29, 2026 -- Secure MQTT telemetry collection across IT/OT boundaries depends on the architecture around the broker, clients, identity and operations, not on choosing an encrypted port, according to TDengine guidance on industrial data ingestion.
Broker placement decides which systems need a route to OT
The broker can sit near sources, in an industrial DMZ or in another approved service zone, depending on the site's threat model, reliability needs and operating ownership. An IT subscriber should connect only to an approved broker endpoint, not to controllers or the wider OT network. The guidance cites NIST's Guide to Operational Technology Security, which requires OT designs to weigh performance, reliability and safety alongside cybersecurity risk.
TLS protects the channel but does not authorize clients
TLS provides confidentiality and integrity in transit and lets clients validate the server certificate. It does not determine whether a client may publish to a command topic or whether a compromised credential stays valid. The MQTT specification leaves authentication and authorization technologies to the deployment, and broker ACL syntax is not standardized, so operators must validate enforcement on their own broker. Accepting any certificate during commissioning removes the server-identity check.
Publish, subscribe and admin rights must be separate
A gateway publishing to a topic such as industrial/site-a/line-2/filler-07/telemetry may need no subscription rights to commands. A historian collector may subscribe to approved telemetry patterns but should not publish to control topics. Administrative access should use distinct operator identities. Broad # wildcard policies should be avoided, and development, test and production environments should be separated by endpoint, identity realm or governed namespace.
Unique client identities and tested rotation limit exposure
Each connection needs a unique client ID, tied to an owner, source system, topic scope, credential type, expiry date and revocation procedure. Reused IDs impair attribution and can cause session conflicts. Operators should test certificate renewal before expiry and rehearse revoking a lost gateway credential.
TDengine TSDB Enterprise's MQTT ingestion connector supports username/password, one-way server-certificate verification and mutual TLS, and requires unique client IDs per MQTT address. These controls cover only the connector-to-broker link, not the broker's ACLs.
Denial-case testing verifies the controls work
Operators should test an expired certificate, an unauthorized publish, an overbroad subscription and a connection from an unapproved network path. Each should be denied, logged and alerted.