Home Assistant External MQTT Broker: Connect to a Cloud Broker over TLS

A home assistant external MQTT broker setup puts the broker outside your house, so devices at a holiday home, a workshop or a relative's flat can talk to the same Home Assistant without port forwarding or VPNs. In this guide you will connect Home Assistant to a cloud broker over TLS, organize topics for several sites, and, as an alternative, bridge the local Mosquitto add-on to the cloud so local devices keep working when the internet is down.

Why Use an External Broker

The Mosquitto add-on is the default choice for a reason: it is local, fast and simple. It becomes awkward when devices are not on your home LAN:

• A sensor at a second property has to reach your home network, which means port forwarding, dynamic DNS and exposing a broker to the internet, or running a VPN on battery-powered hardware.
• Several Home Assistant instances (yours, your parents') cannot easily share one set of devices.
• Other applications, such as a Grafana stack on a server or a mobile app, need their own path in.

An external broker reverses the direction. Every client, including Home Assistant, connects outbound to the same MQTT broker in the cloud. Nothing listens inside your home, and every site is equal.

Pick the direct connection if most devices are remote or you value simplicity. Pick the bridge if critical local automations (lights, heating) depend on MQTT devices in the house.

Option 1: Connect Home Assistant Directly to the Cloud Broker

Create the broker and credentials

Sign up in the ConnectMQ portal, create a broker, and note the generated username, password and client ID. Create separate credentials for Home Assistant and for each remote device, so you can revoke one without touching the others.

Before touching Home Assistant, test the credentials from a computer:

mosquitto_sub -h broker.connectmq.com -p 8883 --capath /etc/ssl/certs \
  -u YOUR_USERNAME -P YOUR_PASSWORD -i YOUR_CLIENT_ID \
  -t "sites/#" -v

On macOS with Homebrew, replace --capath /etc/ssl/certs with --cafile pointing to a CA bundle, for example $(brew --prefix)/etc/ca-certificates/cert.pem. If this command connects and waits silently, the credentials and TLS path are good.

Configure the integration

1. In your Home Assistant user profile, enable Advanced mode. Without it, the client ID and TLS options are hidden.
2. Go to Settings > Devices & services > Add integration > MQTT (or reconfigure your existing MQTT entry).
3. Enter:
   • Broker: broker.connectmq.com
   • Port: 8883
   • Username / Password: the Home Assistant credentials
   • Client ID: the issued client ID, exactly
   • Broker certificate validation: Auto
   • Transport: TCP
   • MQTT protocol: 5 (or 3.1.1; both are supported)
4. Submit and check the integration shows as connected.

Auto validation uses the system CA store, which trusts the Let's Encrypt certificate the broker presents. Never choose Off for an internet connection. If your network blocks 8883 outbound, switch transport to WebSockets with port 8084 and path /mqtt; it runs over HTTPS-like traffic that most firewalls allow. More on that in MQTT over WebSocket.

A remote device

A remote ESP32 publishes to the same broker with its own credentials:

#include <WiFi.h>
#include <WiFiClientSecure.h>
#include <PubSubClient.h>

WiFiClientSecure net;
PubSubClient mqtt(net);

void setup() {
  WiFi.begin("CABIN_WIFI", "CABIN_WIFI_PASSWORD");
  while (WiFi.status() != WL_CONNECTED) delay(250);
  net.setCACert(ISRG_ROOT_X1);   // Let's Encrypt root, PEM string defined elsewhere
  mqtt.setServer("broker.connectmq.com", 8883);
}

void loop() {
  if (!mqtt.connected()) {
    if (mqtt.connect("YOUR_CLIENT_ID", "YOUR_USERNAME", "YOUR_PASSWORD",
                     "sites/cabin/boiler-room/availability", 1, true, "offline")) {
      mqtt.publish("sites/cabin/boiler-room/availability", "online", true);
    } else {
      delay(5000);
      return;
    }
  }
  mqtt.loop();
  static unsigned long last = 0;
  if (millis() - last > 60000) {
    last = millis();
    mqtt.publish("sites/cabin/boiler-room/climate", "{\"temperature\":6.4,\"humidity\":71}");
  }
}

The ESP32 MQTT tutorial shows how to embed the root certificate. In Home Assistant, define the sensor in YAML or let the device announce itself through Home Assistant MQTT discovery.

Topic Design for Several Sites

With many locations on one broker, put the site first:

sites/<site>/<room>/<device>/<measurement-or-command>
sites/home/livingroom/climate
sites/cabin/boiler-room/climate
sites/cabin/boiler-room/availability
sites/workshop/compressor/power

Benefits: one wildcard per site (sites/cabin/#), easy bridging rules, and clear ownership in the ConnectMQ topic explorer. Keep discovery configs under the default homeassistant/ prefix, and if two Home Assistant instances share the broker, give each its own discovery prefix so they do not pick up each other's entities.

Option 2: Bridge the Mosquitto Add-on to the Cloud

A bridge is a connection from your local Mosquitto to the external broker that forwards selected topics in one or both directions. Home Assistant and local devices keep talking to the local broker, so automations survive internet outages, while remote sites appear through the bridge.

1. In the Mosquitto add-on configuration, enable custom config:

customize:
  active: true
  folder: mosquitto

2. Create /share/mosquitto/bridge.conf (for example with the File editor or Samba add-on):

connection connectmq
address broker.connectmq.com:8883
bridge_protocol_version mqttv311
remote_clientid YOUR_CLIENT_ID
remote_username YOUR_USERNAME
remote_password YOUR_PASSWORD
bridge_capath /etc/ssl/certs
bridge_insecure false
cleansession true
try_private false
notifications false
restart_timeout 10 60

# local house data goes up, remote sites come down
topic sites/home/# out 1
topic sites/cabin/# in 1
topic sites/workshop/# in 1

3. Restart the add-on and check its log for a line saying the bridge connected.

try_private false is recommended when the remote side is not another Mosquitto instance. If the add-on cannot find the CA directory in your version, download the ISRG Root X1 PEM into /share/mosquitto/ and use bridge_cafile /share/mosquitto/isrgrootx1.pem instead. Never bridge # in both directions; it creates loops and duplicates.

The bridge is a standard Mosquitto feature acting as an ordinary MQTT client of the cloud broker, so it works with any hosted MQTT broker that accepts TLS and credentials.

Monitoring the Connection

Once Home Assistant depends on an external broker, make connection problems visible. Give every remote device an availability topic with a retained online message and a last will of offline, and use it in your entity definitions so remote sensors turn unavailable instead of showing stale values. A simple Home Assistant automation that notifies you when a remote site's availability entity stays unavailable for ten minutes catches power cuts and router failures at the second property. On the broker side, the live topic explorer shows whether a site is still publishing, and threshold alert rules can watch critical values such as a frost-risk temperature in the cabin.

Security Checklist

1. TLS on every internet connection (8883 or 8084), never plain 1883 with real credentials.
2. One credential set per site or device; revoke instead of rotating everything.
3. Client IDs must match the issued credentials; ConnectMQ binds them together and blocks IPs after repeated failed logins.
4. Do not publish door lock states, alarm codes or presence data to any public MQTT test broker; keep them on your private broker.
5. Keep command topics narrow, and let devices accept only known values.

The general principles are in MQTT security best practices.

Troubleshooting

Connect Home Assistant to ConnectMQ

Create a free Serverless broker at app.connectmq.com, no credit card required. The free plan supports up to 25 connections, enough for Home Assistant, a bridge and a set of remote devices, and you can upgrade later without changing topics. ConnectMQ runs the broker, renews certificates and isolates your traffic. For more projects, see the IoT automation guide and the basic Home Assistant MQTT setup.

Frequently Asked Questions

Will my automations stop if the internet goes down?

With a direct cloud connection, MQTT entities stop updating until the connection returns. If local automations depend on MQTT devices, use the Mosquitto bridge so local traffic never leaves the house.

Do I need to open ports on my router?

No. Home Assistant, the bridge and remote devices all connect outbound to the external broker, so no inbound ports are required.

Can two Home Assistant instances share one external broker?

Yes. Give each instance its own credentials and discovery prefix, and organize topics by site so each instance subscribes only to what it needs.

Which port should I use if 8883 is blocked?

Use secure WebSocket on port 8084 with the path /mqtt, which Home Assistant supports through the WebSockets transport option.