mqttTlsConfig

actual fun mqttTlsConfig(): TLSConfigBuilder.() -> Unit?(source)

TLS customisation applied to the MQTT transports, or null to keep the platform default trust decision.

Self-hosted brokers are commonly fronted by a private or self-signed CA that the user installs into the device credential store. Android used to grant that trust app-wide via <certificates src="user"/> in base-config of network_security_config.xml, which widened every TLS connection the app makes — map tiles, API calls, everything. mqtt-client 0.6.0/0.7.0 added a per-transport hook (TcpTransportFactory/WebSocketTransportFactory), so the grant now applies to the MQTT socket alone.

Supplying a trust manager replaces the platform trust decision for these connections: network-security-config anchors, pinning, and Certificate Transparency policy no longer apply to them. That is a deliberately narrower blast radius than the app-wide anchor it replaces.

expect fun mqttTlsConfig(): TLSConfigBuilder.() -> Unit?(source)

TLS customisation applied to the MQTT transports, or null to keep the platform default trust decision.

Self-hosted brokers are commonly fronted by a private or self-signed CA that the user installs into the device credential store. Android used to grant that trust app-wide via <certificates src="user"/> in base-config of network_security_config.xml, which widened every TLS connection the app makes — map tiles, API calls, everything. mqtt-client 0.6.0/0.7.0 added a per-transport hook (TcpTransportFactory/WebSocketTransportFactory), so the grant now applies to the MQTT socket alone.

Supplying a trust manager replaces the platform trust decision for these connections: network-security-config anchors, pinning, and Certificate Transparency policy no longer apply to them. That is a deliberately narrower blast radius than the app-wide anchor it replaces.

actual fun mqttTlsConfig(): TLSConfigBuilder.() -> Unit?(source)

Desktop has no equivalent of Android's user credential store: the JVM already trusts whatever the running JDK's cacerts holds, and a self-hosted CA is added there (or via -Djavax.net.ssl.trustStore) rather than by the app. Use the platform trust decision unchanged.