TLS runs between TCP and the application. During the handshake the server, and optionally the client, presents an X.509 certificate, the parties agree on cipher suites and derive session keys, and from then on every byte is encrypted and integrity checked. TLS 1.3 shortened the handshake and removed weak options. MQTT over TLS typically uses port 8883, HTTPS uses 443.
In IoT the notable practice is mutual TLS, where the device also holds a certificate and private key, so the broker can authenticate the device without passwords. This ties directly into device identity and PKI. The costs are real on small devices: certificate chains take flash, the handshake takes computation and bandwidth, and keeping root certificates current over a product’s lifetime needs planning. Where the transport is UDP, DTLS provides the same protection. See device identity and PKI.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.