Security

How the connection is encrypted, and how it proves who is connecting.

Opened from the padlock. While a connection is live every field is disabled: what is running cannot be re-described; disconnect first. The protocol you pick decides which sections appear below it.

Protocol

Protocol	Encrypted	Authenticates
PLAINTEXT	No	No
SSL	TLS	Certificate (optional)
SASL_PLAINTEXT	No	SASL
SASL_SSL	TLS	SASL

SASL & OAUTHBEARER

The two SASL protocols ask for a mechanism. The password mechanisms carry a username and password; OAUTHBEARER carries the details a token is fetched with.

PLAINUsername and password, sent as-is, so use it over TLS.

SCRAM-SHA-256 / 512Username and password, hashed in the handshake.

OAUTHBEARERA token endpoint, client id and secret, and an optional scope. The token is fetched over HTTP up front and refreshed before it expires. A wrong secret or an unreachable endpoint is reported in its own words, not as a broker timeout.

GSSAPI (Kerberos) is out of scope: it needs a ticket cache rather than a password.

TLS & verification

Where the authority that signs the broker's certificate comes from (system trust store, a CA file, or apasted CA), and how much of the certificate is checked.

Verification is a ladder, strongest first. There is no rung for checking the name while not checking the certificate, which verifies nothing, so it is left unsayable.

FullCertificate and hostname both checked. The default, and the safe answer.

Certificate onlySignature verified, hostname not: for a broker reached by IP, or whose advertised name differs from its certificate.

InsecureAny certificate accepted, an attacker's included. Honest only against a self-signed broker on your own machine.

Lowering it is the one thing here you cannot do quietly: the consequence is spelled out where the rung is chosen, and the padlock reads weakened afterwards.

Client identity (mutual TLS)

Only needed when the broker asks you to prove who you are with a certificate. Two shapes, and they are alternatives:

Certificate & key

A certificate and its private key, each a file path or pasted PEM, with a key password when the key is encrypted.

PKCS#12 keystore

The .p12 shape the Java world hands out: a path and its password.

Secrets & variables

What you type in these fields lives in memory while the app is open and isnever written to disk.

To have a secret remembered, put a {{variable}}in the field and mark that variable secret in the global environment, and it is then kept in your OS keychain. Every field can be parameterised this way, not just the password: a CA path or a token endpoint differs between environments too.

Variables are resolved once, for a single connection attempt, and dropped. Storing what one resolved to would be writing the secret down.

Connecting Topic Management