.p12 / .pfx and PEM
Import the CA as PEM and your client identity as a .p12/.pfx bundle, with passphrase support.
Feature
Certificate Manager
TLS and mTLS without the guesswork. Import your certificates and keys, let the app validate the chain, expiry, hostname and ALPN, and keep every secret in the iOS Keychain.
Certificates, validated before you connect
TLS is the step where most MQTT connections break. The Certificate Manager imports your CA as a PEM and your client identity as a .p12/.pfx bundle, checks the trust chain and expiry, matches the hostname against the certificate's SAN/CN, and confirms the ALPN protocol your broker expects.
Works with: Mosquitto with TLS, self-signed brokers, AWS IoT Core (ALPN x-amzn-mqtt-ca), HiveMQ, EMQX and any broker that speaks TLS or mutual TLS.
What it handles
From self-signed to AWS IoT mutual TLS
Chain & expiry checks
Validates the trust chain and flags an expired or not-yet-valid certificate before you try to connect.
SAN / CN matching
Catches a hostname mismatch between your broker address and the certificate's Subject Alternative Names.
ALPN & SNI
Set an ALPN protocol list (including AWS IoT's x-amzn-mqtt-ca) and override SNI for brokers behind shared endpoints.
mTLS
Present a client certificate for mutual TLS, with the private key and passphrase kept in the iOS Keychain.
SHA-256 fingerprints
Verify a self-signed or pinned certificate by its fingerprint instead of trusting blindly.
Certificate Manager FAQ
Which certificate formats can I import?
The CA as a PEM certificate, and your client identity (certificate plus private key) as a PKCS#12 .p12/.pfx bundle. Passphrase-protected bundles are supported; a standalone PEM private key is not.
How do I connect to AWS IoT Core?
Import your device identity as a .p12/.pfx bundle, then set the ALPN protocol to x-amzn-mqtt-ca (or use port 8883). It handles SNI for you and validates the chain.
Where are my private keys stored?
Client certificates, private keys and passphrases live in the iOS Keychain, not in the broker profile or any export. Diagnostics redact certificate material.
Why does my TLS connection fail even with the right certificate?
Common causes are an expired chain, a hostname that doesn't match the certificate's SAN/CN, a missing intermediate certificate, or a broker that requires a specific ALPN. It flags each of these so you can see which one applies.
Stop fighting TLS handshakes
The Certificate Manager ships in MQTT Commander for iPhone and iPad.
Free · Pro unlock $4.99, one-time