MQTT over TLS
Default TLS-protected MQTT broker endpoint.
MQTT over TLS endpoints in environments where this service is explicitly configured.
Client to server
Validate certificates, require client authentication and topic-level authorisation, and rotate device credentials.