Authentication using only certificate

Have you set up client certificate authentication on the broker message vpn?

Are you using a self-managed broker or a PubSub+ Cloud instance?