December 2, 2025 - MQTT Service will enforce Common Name validation for certificate-authenticated clients

Cumulocity Change Log Platform services
, , ,
1

Context

Change Type: Announcement
Product area: Platform services
Component: MQTT

Technical details

Build artifact: mqtt-service

Description

Caution
This change only affects the new Cumulocity MQTT Service capability.

The existing Cumulocity Core MQTT capability is not affected.

Introduction

To strengthen identity assurance for certificate-authenticated MQTT clients, the Cumulocity MQTT Service will begin enforcing Common Name (CN) validation during client certificate authentication.

Currently, the MQTT Service accepts certificates where the CN does not match the MQTT client ID.
After this change, the CN must match the client ID used during connection.
This tight binding of certificates to devices will significantly reduce the risk of certificate misuse.

What is changing?

When an MQTT client connects using certificate-based authentication, the Common Name (CN) in the certificate must match the MQTT device ID.

MQTT clients may identify themselves using either of the following client ID formats:

  1. <deviceId> – standard format
  2. d:<deviceId> – supported only for legacy SmartREST devices migrating to the MQTT Service. This format must not be used for new devices.

However, in both cases, the certificate’s CN must be:

  • CN == <deviceId>

Any certificate whose CN does not equal the device ID will fail authentication.

Only certificate-authenticated clients are affected; all other authentication methods remain unchanged.

Impact on existing MQTT clients

This is a breaking change.
Devices using certificates whose CN does not match the device ID will fail authentication once enforcement begins.

Customers should verify and update their certificate issuance processes during the grace period.

Please contact Cumulocity Support if you have any questions or concerns about these changes.

Roll-out plan

Info
Because the Cumulocity MQTT Service is currently in Public Preview, it is not subject to the standard 6-month compatibility notice period defined in the Cumulocity IoT Compatibility policy.

To allow a smooth transition, CN validation will be introduced no sooner than four weeks after this announcement.