My IoT device creates a BLE connection with a smartphone from which it connects to cloud. When integrating a TLS, should it be above MQTT or below? All implementation I have reviewed so far does it below MQTT layer.
TLS handshake and record message are put into MQTT payload and send over BLE to phone which would then forward it through TCP/IP to the cloud. The smartphone is just forwarding MQTT packet , and not aware of its content.
First TLS session is establish between device and cloud. First approach is to have the device create a IP packet and send it over BLE to smartphone to be forwarded to cloud. Only when TLS is established, then start sending MQTT over this TLS session. As I review the literature, this is more common approach. But this would add some more code to handle creating IP packet.