# MQTT Distributor Certificate

**URL:** <https://forum.cirrus-link.com/t/mqtt-distributor-certificate/70>\
**Category:** Ignition Modules\
**Tags:** mqtt-distributor\
**Created:** [March 26, 2021, 11:10am UTC](https://forum.cirrus-link.com/t/mqtt-distributor-certificate/70 "2021-03-26T11:10:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![MBjerglund](https://avatars.discourse-cdn.com/v4/letter/m/3be4f8/32.png) [@MBjerglund](https://forum.cirrus-link.com/u/MBjerglund)\
**Post date:** [March 26, 2021, 11:10am UTC](https://forum.cirrus-link.com/t/mqtt-distributor-certificate/70/1 "2021-03-26T11:10:46Z")

</div>

Hi,

I have set up a server running Ignition 8.1.3 and I am using the MQTT Distributor Module as the MQTT Broker.  
I have Groov RIO set up at another location and I have connected that one to the MQTT Distributor without any difficulties.  
However, I would like to enable TLS/SSL for security. What certificate to use here?

As I understand it the MQTT Distributor Module can use the SSL Certificate applied to the Ignition Gateway from version 4.0.4 and up.  
I have installed a certificate on the Ignition Gateway and everything is running over HTTPS (8043).

I have tried to use the same .crt file for the Groov RIO for the MQTT connection to the MQTT Distributor Module. However, here I get this status message on the gateway:

 ![image](https://canada1.discourse-cdn.com/flex028/uploads/cirrus_link/original/1X/41786a113ba0c1cdc29889db3f3116958c2c356e.png)

So it looks like the MQTT Distributor is not recognizing the certificate.

Do I need to create a specific certificate for the Groov RIO? If so, how do I add that to the MQTT Distributor so that it recognises the Certificate?

I am definitely in uncharted territory so any help is much appreciated.

---

<div class="post-metadata">

**Author:** ![nathan.davenport](https://avatars.discourse-cdn.com/v4/letter/n/3ab097/32.png) [@nathan.davenport](https://forum.cirrus-link.com/u/nathan.davenport)\
**Post date:** [March 26, 2021, 4:32pm UTC](https://forum.cirrus-link.com/t/mqtt-distributor-certificate/70/2 "2021-03-26T16:32:25Z")

</div>

Is the SSL certificate installed on the Ignition Gateway hosting Distributor real-signed (e.g., Digicert CA) or self-signed (test/internal CA)? If it is real-signed, you shouldn’t need to add any additional certs at the Edge/Groov RIO as the CA should already be trusted. If the certificate is self-signed, you will need to upload the appropriate certificates that make up chain of trust (CA Root certificate and any CA Intermediate certificates) to the Edge/Groov RIO.

If this answer doesn’t help to resolve your issues, I recommend reaching out to [support@cirrus-link.com](mailto:support@cirrus-link.com) so we can setup a call to review your certificate setup and configuration together.