For local development we use [Mosquitto](https://mosquitto.org/) as our MQTT broker, with TLS enabled.
First generate local development certs using:
```
make gen-local-tls-certs
```
This will create CA, server, and client certificates suitable for local development. Server and CA certs are created in `./.mosquitto/certs`. The client cert is create in the project root.
- [Caddy as reverse proxy](https://github.com/caddyserver/caddy)
- [Using Python paho MQTT client with TLS](https://cedalo.com/blog/configuring-paho-mqtt-python-client-with-examples/)
- [ESP32 Micropython MQTT with TLS](https://dev.to/bassparanoya/esp32-micropython-mqtt-tls-28fd): Note cert file format for uPy MQTT client needs to be in .der format which is a binary format.