diff --git a/interface/src/framework/mqtt/MqttSettingsForm.tsx b/interface/src/framework/mqtt/MqttSettingsForm.tsx
index d6b825add..309bcbeb4 100644
--- a/interface/src/framework/mqtt/MqttSettingsForm.tsx
+++ b/interface/src/framework/mqtt/MqttSettingsForm.tsx
@@ -1,12 +1,17 @@
 import CancelIcon from '@mui/icons-material/Cancel';
 import WarningIcon from '@mui/icons-material/Warning';
+import PowerSettingsNewIcon from '@mui/icons-material/PowerSettingsNew';
 import { Button, Checkbox, MenuItem, Grid, Typography, InputAdornment, TextField } from '@mui/material';
 import { useState } from 'react';
 import type { ValidateFieldsError } from 'async-validator';
 import type { FC } from 'react';
+import { toast } from 'react-toastify';
+import RestartMonitor from '../system/RestartMonitor';
+import { useRequest } from 'alova';
 
 import type { MqttSettings } from 'types';
 import * as MqttApi from 'api/mqtt';
+import * as SystemApi from 'api/system';
 import {
   BlockFormControlLabel,
   ButtonRow,
@@ -14,6 +19,7 @@ import {
   SectionContent,
   ValidatedPasswordField,
   ValidatedTextField,
+  MessageBox,
   BlockNavigation
 } from 'components';
 import { useI18nContext } from 'i18n/i18n-react';
@@ -32,15 +38,21 @@ const MqttSettingsForm: FC = () => {
     setDirtyFlags,
     blocker,
     saveData,
-    errorMessage
+    errorMessage,
+    restartNeeded
   } = useRest<MqttSettings>({
     read: MqttApi.readMqttSettings,
     update: MqttApi.updateMqttSettings
   });
 
+  const { send: restartCommand } = useRequest(SystemApi.restart(), {
+    immediate: false
+  });
+
   const { LL } = useI18nContext();
 
   const [fieldErrors, setFieldErrors] = useState<ValidateFieldsError>();
+  const [restarting, setRestarting] = useState(false);
 
   const updateFormValue = updateValueDirty(origData, dirtyFlags, setDirtyFlags, updateDataValue);
 
@@ -59,6 +71,13 @@ const MqttSettingsForm: FC = () => {
       }
     };
 
+    const restart = async () => {
+      await restartCommand().catch((error) => {
+        toast.error(error.message);
+      });
+      setRestarting(true);
+    };
+
     return (
       <>
         <BlockFormControlLabel
@@ -168,6 +187,17 @@ const MqttSettingsForm: FC = () => {
               <MenuItem value={2}>2</MenuItem>
             </TextField>
           </Grid>
+          <Grid item xs={12} sm={6}>
+            <ValidatedPasswordField
+              name="rootCA"
+              label={LL.CERT()}
+              fullWidth
+              variant="outlined"
+              value={data.rootCA}
+              onChange={updateFormValue}
+              margin="normal"
+            />
+          </Grid>
         </Grid>
         <BlockFormControlLabel
           control={<Checkbox name="clean_session" checked={data.clean_session} onChange={updateFormValue} />}
@@ -400,7 +430,15 @@ const MqttSettingsForm: FC = () => {
           </Grid>
         </Grid>
 
-        {dirtyFlags && dirtyFlags.length !== 0 && (
+        {restartNeeded && (
+          <MessageBox my={2} level="warning" message={LL.RESTART_TEXT()}>
+            <Button startIcon={<PowerSettingsNewIcon />} variant="contained" color="error" onClick={restart}>
+              {LL.RESTART()}
+            </Button>
+          </MessageBox>
+        )}
+
+        {!restartNeeded && dirtyFlags && dirtyFlags.length !== 0 && (
           <ButtonRow>
             <Button
               startIcon={<CancelIcon />}
@@ -431,7 +469,7 @@ const MqttSettingsForm: FC = () => {
   return (
     <SectionContent title={LL.SETTINGS_OF('MQTT')} titleGutter>
       {blocker ? <BlockNavigation blocker={blocker} /> : null}
-      {content()}
+      {restarting ? <RestartMonitor /> : content()}
     </SectionContent>
   );
 };
diff --git a/interface/src/i18n/de/index.ts b/interface/src/i18n/de/index.ts
index 3acac78c8..dfbab3705 100644
--- a/interface/src/i18n/de/index.ts
+++ b/interface/src/i18n/de/index.ts
@@ -45,9 +45,9 @@ const de: Translation = {
   CHANGE_VALUE: 'Wert ändern',
   CANCEL: 'Abbrechen',
   RESET: 'Zurücksetzen',
-  APPLY_CHANGES: 'Apply Changes ({0})', // TODO translate
-  UPDATE: 'Update', // TODO translate
-  EXECUTE: 'Execute', // TODO translate
+  APPLY_CHANGES: 'Änderungen anwenden ({0})',
+  UPDATE: 'Update',
+  EXECUTE: 'Ausführen',
   REMOVE: 'Entfernen',
   PROBLEM_UPDATING: 'Problem beim Aktualisieren',
   PROBLEM_LOADING: 'Problem beim Laden',
@@ -180,7 +180,7 @@ const de: Translation = {
   LOG_OF: '{0} Log',
   STATUS_OF: '{0} Status',
   UPLOAD_DOWNLOAD: 'Hoch-/Herunterladen',
-  VERSION_ON: 'You are currently on', // TODO translate
+  VERSION_ON: 'Sie verwenden derzeit',
   SYSTEM_APPLY_FIRMWARE: 'um die neue Firmware anzuwenden',
   CLOSE: 'Schließen',
   USE: 'Verwenden Sie',
@@ -240,7 +240,7 @@ const de: Translation = {
   MQTT_PUBLISH_TEXT_2: 'Veröffentliche als Kommando-Topic (ioBroker)',
   MQTT_PUBLISH_TEXT_3: 'Aktiviere `MQTT Discovery`',
   MQTT_PUBLISH_TEXT_4: 'Prefix für die `Discovery`-Topics',
-  MQTT_PUBLISH_TEXT_5: 'Discovery type', // TODO translate
+  MQTT_PUBLISH_TEXT_5: 'Discovery Typ',
   MQTT_PUBLISH_INTERVALS: 'Veröffentlichungs-Intervalle',
   MQTT_INT_BOILER: 'Boiler und Wärmepumpen',
   MQTT_INT_THERMOSTATS: 'Thermostate',
@@ -282,7 +282,7 @@ const de: Translation = {
   SCAN_AGAIN: 'Erneute Suche',
   NETWORK_SCANNER: 'Netzwerk Suche',
   NETWORK_NO_WIFI: 'Keine WiFi Netzwerke gefunden',
-  NETWORK_BLANK_SSID: 'Freilassen um WiFi zu deaktivieren',
+  NETWORK_BLANK_SSID: 'Freilassen um WiFi zu deaktivieren und ETH zu aktivieren',
   TX_POWER: 'Tx Leistung',
   HOSTNAME: 'Hostname',
   NETWORK_DISABLE_SLEEP: 'Deaktiviere WiFi Schlafmodus',
@@ -319,10 +319,11 @@ const de: Translation = {
   SCHEDULE_TIMER_3: 'jede Stunde',
   CUSTOM_ENTITIES: 'Individuelle Entitäten',
   ENTITIES_HELP_1: 'Abfrage von Werten auf dem EMS-Bus',
-  ENTITIES_UPDATED: 'Entities Updated', // TODO translate
+  ENTITIES_UPDATED: 'Entitäten gespeichert',
   WRITEABLE: 'Schreibbar',
-  SHOWING: 'Showing', // TODO translate
-  SEARCH: 'Search' // TODO translate
+  SHOWING: 'Anzeigen von',
+  SEARCH: 'Suche',
+  CERT: 'TSL Zertifikat (Freilassen um TSL zu deaktivieren)'
 };
 
 export default de;
diff --git a/interface/src/i18n/en/index.ts b/interface/src/i18n/en/index.ts
index 83d123376..4a2486a55 100644
--- a/interface/src/i18n/en/index.ts
+++ b/interface/src/i18n/en/index.ts
@@ -282,7 +282,7 @@ const en: Translation = {
   SCAN_AGAIN: 'Scan again',
   NETWORK_SCANNER: 'Network Scanner',
   NETWORK_NO_WIFI: 'No WiFi networks found',
-  NETWORK_BLANK_SSID: 'leave blank to disable WiFi',
+  NETWORK_BLANK_SSID: 'leave blank to disable WiFi and enable ETH',
   TX_POWER: 'Tx Power',
   HOSTNAME: 'Hostname',
   NETWORK_DISABLE_SLEEP: 'Disable WiFi Sleep Mode',
@@ -322,8 +322,8 @@ const en: Translation = {
   ENTITIES_UPDATED: 'Entities Updated',
   WRITEABLE: 'Writeable',
   SHOWING: 'Showing',
-  SEARCH: 'Search'
-
+  SEARCH: 'Search',
+  CERT: 'TSL root certificate (leave blank to disable TSL)'
 };
 
 export default en;
diff --git a/interface/src/i18n/fr/index.ts b/interface/src/i18n/fr/index.ts
index 390407573..965803614 100644
--- a/interface/src/i18n/fr/index.ts
+++ b/interface/src/i18n/fr/index.ts
@@ -282,7 +282,7 @@ const fr: Translation = {
   SCAN_AGAIN: 'Rescanner',
   NETWORK_SCANNER: 'Scan réseau',
   NETWORK_NO_WIFI: 'Pas de réseau WiFi trouvé',
-  NETWORK_BLANK_SSID: 'laisser vide pour désactiver le WiFi',
+  NETWORK_BLANK_SSID: 'laisser vide pour désactiver le WiFi', // and enable ETH // TODO translate
   TX_POWER: 'Puissance Tx',
   HOSTNAME: 'Nom d\'hôte',
   NETWORK_DISABLE_SLEEP: 'Désactiver le mode veille du WiFi',
@@ -322,7 +322,8 @@ const fr: Translation = {
   ENTITIES_UPDATED: 'Entities Updated', // TODO translate
   WRITEABLE: 'Writeable', // TODO translate
   SHOWING: 'Showing', // TODO translate
-  SEARCH: 'Search' // TODO translate
+  SEARCH: 'Search', // TODO translate
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default fr;
diff --git a/interface/src/i18n/it/index.ts b/interface/src/i18n/it/index.ts
index c9719e10e..f122a8fec 100644
--- a/interface/src/i18n/it/index.ts
+++ b/interface/src/i18n/it/index.ts
@@ -324,8 +324,8 @@ const it: Translation = {
   ENTITIES_UPDATED: 'Entità aggiornate',
   WRITEABLE: 'Scrivibile',
   SHOWING: 'Visualizza',
-  SEARCH: 'Ricerca'
-
+  SEARCH: 'Ricerca',
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default it;
diff --git a/interface/src/i18n/nl/index.ts b/interface/src/i18n/nl/index.ts
index 80957c9e0..1464dfcb5 100644
--- a/interface/src/i18n/nl/index.ts
+++ b/interface/src/i18n/nl/index.ts
@@ -282,7 +282,7 @@ const nl: Translation = {
   SCAN_AGAIN: 'Opnieuw scannen',
   NETWORK_SCANNER: 'Netwerk Scanner',
   NETWORK_NO_WIFI: 'Geen WiFi networken gevonden',
-  NETWORK_BLANK_SSID: 'laat leeg om WiFi uit te schakelen',
+  NETWORK_BLANK_SSID: 'laat leeg om WiFi uit te schakelen', // and enable ETH // TODO translate
   TX_POWER: 'Tx Vermogen',
   HOSTNAME: 'Hostname',
   NETWORK_DISABLE_SLEEP: 'WiFi Sleep Mode uitzetten',
@@ -322,7 +322,8 @@ const nl: Translation = {
   ENTITIES_UPDATED: 'Entiteiten bijgewerkt',
   WRITEABLE: 'Beschrijfbare',
   SHOWING: 'Tonen',
-  SEARCH: 'Zoek'
+  SEARCH: 'Zoek',
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default nl;
diff --git a/interface/src/i18n/no/index.ts b/interface/src/i18n/no/index.ts
index 21bc1346a..dcec7796c 100644
--- a/interface/src/i18n/no/index.ts
+++ b/interface/src/i18n/no/index.ts
@@ -282,7 +282,7 @@ const no: Translation = {
   SCAN_AGAIN: 'Søk igjen',
   NETWORK_SCANNER: 'Nettverk Scanner',
   NETWORK_NO_WIFI: 'Ingen trådløse nett funnet',
-  NETWORK_BLANK_SSID: 'la feltet være blankt for å deaktivisere trådløst nettverk',
+  NETWORK_BLANK_SSID: 'la feltet være blankt for å deaktivisere trådløst nettverk', // and enable ETH // TODO translate
   TX_POWER: 'Tx Effekt',
   HOSTNAME: 'Hostname',
   NETWORK_DISABLE_SLEEP: 'Hindre at trådløst nettverk går i Sleep Mode',
@@ -322,8 +322,8 @@ const no: Translation = {
   ENTITIES_UPDATED: 'Entities Updated', // TODO translate
   WRITEABLE: 'Writeable', // TODO translate
   SHOWING: 'Showing', // TODO translate
-  SEARCH: 'Search' // TODO translate
-  
+  SEARCH: 'Search', // TODO translate
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default no;
diff --git a/interface/src/i18n/pl/index.ts b/interface/src/i18n/pl/index.ts
index 5d46e4c4b..2073acb1f 100644
--- a/interface/src/i18n/pl/index.ts
+++ b/interface/src/i18n/pl/index.ts
@@ -282,7 +282,7 @@ const pl: BaseTranslation = {
   SCAN_AGAIN: 'Skanuj ponownie',
   NETWORK_SCANNER: 'Skaner sieci WiFi',
   NETWORK_NO_WIFI: 'Brak sieci WiFi w zasięgu',
-  NETWORK_BLANK_SSID: 'pozostaw puste aby wyłączyć WiFi',
+  NETWORK_BLANK_SSID: 'pozostaw puste aby wyłączyć WiFi', // and enable ETH // TODO translate
   TX_POWER: 'Moc nadawania',
   HOSTNAME: 'Nazwa w sieci',
   NETWORK_DISABLE_SLEEP: 'Wyłącz tryb uśpienia WiFi',
@@ -322,8 +322,8 @@ const pl: BaseTranslation = {
   ENTITIES_UPDATED: 'Niestandardowe encje zostały uaktualnione.',
   WRITEABLE: 'zapisywalna',
   SHOWING: 'Wyświetlane',
-  SEARCH: 'Szukaj'
-
+  SEARCH: 'Szukaj',
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default pl;
diff --git a/interface/src/i18n/sv/index.ts b/interface/src/i18n/sv/index.ts
index e34ddba92..2f6e27381 100644
--- a/interface/src/i18n/sv/index.ts
+++ b/interface/src/i18n/sv/index.ts
@@ -282,7 +282,7 @@ const sv: Translation = {
   SCAN_AGAIN: 'Sök igen',
   NETWORK_SCANNER: 'Hittade nätverk',
   NETWORK_NO_WIFI: 'Inga WiFi-nätverk hittades',
-  NETWORK_BLANK_SSID: 'lämna blankt för att inaktivera WiFi',
+  NETWORK_BLANK_SSID: 'lämna blankt för att inaktivera WiFi', // and enable ETH // TODO translate
   TX_POWER: 'Tx Effekt',
   HOSTNAME: 'Värdnamn',
   NETWORK_DISABLE_SLEEP: 'Inaktivera sömnläge',
@@ -322,8 +322,8 @@ const sv: Translation = {
   ENTITIES_UPDATED: 'Entities Updated', // TODO translate
   WRITEABLE: 'Writeable', // TODO translate
   SHOWING: 'Showing', // TODO translate
-  SEARCH: 'Search' // TODO translate
-
+  SEARCH: 'Search', // TODO translate
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default sv;
diff --git a/interface/src/i18n/tr/index.ts b/interface/src/i18n/tr/index.ts
index 44a5dab43..93055252f 100644
--- a/interface/src/i18n/tr/index.ts
+++ b/interface/src/i18n/tr/index.ts
@@ -282,7 +282,7 @@ const tr: Translation = {
   SCAN_AGAIN: 'Tekrar tara',
   NETWORK_SCANNER: 'Ağ Tarayıcısı',
   NETWORK_NO_WIFI: 'Hiçbir Kablosuz Ağ bulunamadı',
-  NETWORK_BLANK_SSID: 'Kablosuz ağı devre dışı bırakmak için boş bırakın',
+  NETWORK_BLANK_SSID: 'Kablosuz ağı devre dışı bırakmak için boş bırakın', // and enable ETH // TODO translate
   TX_POWER: 'Aktarım gücü',
   HOSTNAME: 'Ana Makine Adı',
   NETWORK_DISABLE_SLEEP: 'Kablosuz uyku modunu devre dışına al',
@@ -322,8 +322,8 @@ const tr: Translation = {
   ENTITIES_UPDATED: 'Entities Updated', // TODO translate
   WRITEABLE: 'Writeable', // TODO translate
   SHOWING: 'Showing', // TODO translate
-  SEARCH: 'Search' // TODO translate
-
+  SEARCH: 'Search', // TODO translate
+  CERT: 'TSL root certificate (leave blank to disable TSL)' // TODO translate
 };
 
 export default tr;
diff --git a/interface/src/types/mqtt.ts b/interface/src/types/mqtt.ts
index f82fa6c26..7194fcd7d 100644
--- a/interface/src/types/mqtt.ts
+++ b/interface/src/types/mqtt.ts
@@ -24,6 +24,7 @@ export interface MqttSettings {
   host: string;
   port: number;
   base: string;
+  rootCA: string;
   username: string;
   password: string;
   client_id: string;
diff --git a/lib/framework/ESP8266React.h b/lib/framework/ESP8266React.h
index 32ca0f55c..e44397c9e 100644
--- a/lib/framework/ESP8266React.h
+++ b/lib/framework/ESP8266React.h
@@ -59,10 +59,17 @@ class ESP8266React {
         return &_mqttSettingsService;
     }
 
-    espMqttClient * getMqttClient() {
+    MqttClient * getMqttClient() {
         return _mqttSettingsService.getMqttClient();
     }
 
+    void setWill(const char * will_topic) {
+        _mqttSettingsService.setWill(will_topic);
+    }
+    void onMessage(espMqttClientTypes::OnMessageCallback callback) {
+        _mqttSettingsService.onMessage(callback);
+    }
+
     void factoryReset() {
         _factoryResetService.factoryReset();
     }
diff --git a/lib/framework/MqttSettingsService.cpp b/lib/framework/MqttSettingsService.cpp
index 59b5c0f43..949c0cda9 100644
--- a/lib/framework/MqttSettingsService.cpp
+++ b/lib/framework/MqttSettingsService.cpp
@@ -2,7 +2,7 @@
 
 #include "../../src/emsesp_stub.hpp" // proddy added
 
-using namespace std::placeholders; // for `_1` etc
+using namespace std::placeholders;   // for `_1` etc
 
 /**
  * Retains a copy of the cstr provided in the pointer provided using dynamic allocation.
@@ -34,10 +34,8 @@ MqttSettingsService::MqttSettingsService(AsyncWebServer * server, FS * fs, Secur
     , _reconfigureMqtt(false)
     , _disconnectedAt(0)
     , _disconnectReason(espMqttClientTypes::DisconnectReason::TCP_DISCONNECTED)
-    , _mqttClient(espMqttClientTypes::UseInternalTask::NO) {
+    , _mqttClient(nullptr) {
     WiFi.onEvent(std::bind(&MqttSettingsService::WiFiEvent, this, _1, _2));
-    _mqttClient.onConnect(std::bind(&MqttSettingsService::onMqttConnect, this, _1));
-    _mqttClient.onDisconnect(std::bind(&MqttSettingsService::onMqttDisconnect, this, _1));
     addUpdateHandler([&](const String & originId) { onConfigUpdated(); }, false);
 }
 
@@ -46,18 +44,27 @@ MqttSettingsService::~MqttSettingsService() {
 
 void MqttSettingsService::begin() {
     _fsPersistence.readFromFS();
+    if (_mqttClient != nullptr) {
+        delete _mqttClient;
+    }
+    if (_state.rootCA.length() > 0) {
+        _mqttClient = static_cast<MqttClient *>(new espMqttClientSecure(espMqttClientTypes::UseInternalTask::NO));
+        static_cast<espMqttClientSecure *>(_mqttClient)->onConnect(std::bind(&MqttSettingsService::onMqttConnect, this, _1));
+        static_cast<espMqttClientSecure *>(_mqttClient)->onDisconnect(std::bind(&MqttSettingsService::onMqttDisconnect, this, _1));
+    } else {
+        _mqttClient = static_cast<MqttClient *>(new espMqttClient(espMqttClientTypes::UseInternalTask::NO));
+        static_cast<espMqttClient *>(_mqttClient)->onConnect(std::bind(&MqttSettingsService::onMqttConnect, this, _1));
+        static_cast<espMqttClient *>(_mqttClient)->onDisconnect(std::bind(&MqttSettingsService::onMqttDisconnect, this, _1));
+    }
 }
 
 void MqttSettingsService::loop() {
     if (_reconfigureMqtt || (_disconnectedAt && (uint32_t)(uuid::get_uptime() - _disconnectedAt) >= MQTT_RECONNECTION_DELAY)) {
         // reconfigure MQTT client
-        _disconnectedAt = uuid::get_uptime();
-        if (configureMqtt()) {
-            _disconnectedAt = 0;
-        }
+        _disconnectedAt  = configureMqtt() ? 0 : uuid::get_uptime();
         _reconfigureMqtt = false;
     }
-    _mqttClient.loop();
+    _mqttClient->loop();
 }
 
 bool MqttSettingsService::isEnabled() {
@@ -65,19 +72,35 @@ bool MqttSettingsService::isEnabled() {
 }
 
 bool MqttSettingsService::isConnected() {
-    return _mqttClient.connected();
+    return _mqttClient->connected();
 }
 
 const char * MqttSettingsService::getClientId() {
-    return _mqttClient.getClientId();
+    return _mqttClient->getClientId();
+}
+
+void MqttSettingsService::setWill(const char * topic) {
+    if (_state.rootCA.length() > 0) {
+        static_cast<espMqttClientSecure *>(_mqttClient)->setWill(topic, 1, true, "offline");
+    } else {
+        static_cast<espMqttClient *>(_mqttClient)->setWill(topic, 1, true, "offline");
+    }
+}
+
+void MqttSettingsService::onMessage(espMqttClientTypes::OnMessageCallback callback) {
+    if (_state.rootCA.length() > 0) {
+        static_cast<espMqttClientSecure *>(_mqttClient)->onMessage(callback);
+    } else {
+        static_cast<espMqttClient *>(_mqttClient)->onMessage(callback);
+    }
 }
 
 espMqttClientTypes::DisconnectReason MqttSettingsService::getDisconnectReason() {
     return _disconnectReason;
 }
 
-espMqttClient * MqttSettingsService::getMqttClient() {
-    return &_mqttClient;
+MqttClient * MqttSettingsService::getMqttClient() {
+    return _mqttClient;
 }
 
 void MqttSettingsService::onMqttConnect(bool sessionPresent) {
@@ -118,7 +141,7 @@ void MqttSettingsService::WiFiEvent(WiFiEvent_t event, WiFiEventInfo_t info) {
     case ARDUINO_EVENT_ETH_DISCONNECTED:
         if (_state.enabled) {
             // emsesp::EMSESP::logger().info("Network connection dropped, stopping MQTT client");
-            _mqttClient.disconnect(true);
+            _mqttClient->disconnect(true);
         }
         break;
 
@@ -128,29 +151,53 @@ void MqttSettingsService::WiFiEvent(WiFiEvent_t event, WiFiEventInfo_t info) {
 }
 
 bool MqttSettingsService::configureMqtt() {
+    if (_mqttClient == nullptr) {
+        begin();
+    }
     // disconnect if connected
-    _mqttClient.disconnect(true);
+    _mqttClient->disconnect(true);
     // only connect if WiFi is connected and MQTT is enabled
-    if (_state.enabled && emsesp::EMSESP::system_.network_connected() && !_state.host.isEmpty()) {
-        // emsesp::EMSESP::logger().info("Configuring MQTT client");
-        _mqttClient.setServer(retainCstr(_state.host.c_str(), &_retainedHost), _state.port);
-        if (_state.username.length() > 0) {
-            _mqttClient.setCredentials(retainCstr(_state.username.c_str(), &_retainedUsername),
-                                       retainCstr(_state.password.length() > 0 ? _state.password.c_str() : nullptr, &_retainedPassword));
+    if (_state.enabled && !_state.host.isEmpty()) {
+        _reconfigureMqtt = false;
+        if (_state.rootCA.length() > 0) {
+            // static_cast<espMqttClientSecure *>(_mqttClient)->setInsecure();
+            String cert = "-----BEGIN CERTIFICATE-----\n" + _state.rootCA + "-----END CERTIFICATE-----\n";
+            static_cast<espMqttClientSecure *>(_mqttClient)->setCACert(retainCstr(cert.c_str(), &_retainedRootCA));
+            static_cast<espMqttClientSecure *>(_mqttClient)->setServer(retainCstr(_state.host.c_str(), &_retainedHost), _state.port);
+            if (_state.username.length() > 0) {
+                static_cast<espMqttClientSecure *>(_mqttClient)
+                    ->setCredentials(retainCstr(_state.username.c_str(), &_retainedUsername),
+                                     retainCstr(_state.password.length() > 0 ? _state.password.c_str() : nullptr, &_retainedPassword));
+            } else {
+                static_cast<espMqttClientSecure *>(_mqttClient)->setCredentials(retainCstr(nullptr, &_retainedUsername), retainCstr(nullptr, &_retainedPassword));
+            }
+            static_cast<espMqttClientSecure *>(_mqttClient)->setClientId(retainCstr(_state.clientId.c_str(), &_retainedClientId));
+            static_cast<espMqttClientSecure *>(_mqttClient)->setKeepAlive(_state.keepAlive);
+            static_cast<espMqttClientSecure *>(_mqttClient)->setCleanSession(_state.cleanSession);
+            return _mqttClient->connect();
         } else {
-            _mqttClient.setCredentials(retainCstr(nullptr, &_retainedUsername), retainCstr(nullptr, &_retainedPassword));
+            // emsesp::EMSESP::logger().info("Configuring MQTT client");
+            static_cast<espMqttClient *>(_mqttClient)->setServer(retainCstr(_state.host.c_str(), &_retainedHost), _state.port);
+            if (_state.username.length() > 0) {
+                static_cast<espMqttClient *>(_mqttClient)
+                    ->setCredentials(retainCstr(_state.username.c_str(), &_retainedUsername),
+                                     retainCstr(_state.password.length() > 0 ? _state.password.c_str() : nullptr, &_retainedPassword));
+            } else {
+                static_cast<espMqttClient *>(_mqttClient)->setCredentials(retainCstr(nullptr, &_retainedUsername), retainCstr(nullptr, &_retainedPassword));
+            }
+            static_cast<espMqttClient *>(_mqttClient)->setClientId(retainCstr(_state.clientId.c_str(), &_retainedClientId));
+            static_cast<espMqttClient *>(_mqttClient)->setKeepAlive(_state.keepAlive);
+            static_cast<espMqttClient *>(_mqttClient)->setCleanSession(_state.cleanSession);
+            return _mqttClient->connect();
+            // } else {
+            // emsesp::EMSESP::logger().info("Error configuring MQTT client");
         }
-        _mqttClient.setClientId(retainCstr(_state.clientId.c_str(), &_retainedClientId));
-        _mqttClient.setKeepAlive(_state.keepAlive);
-        _mqttClient.setCleanSession(_state.cleanSession);
-        return _mqttClient.connect();
-        // } else {
-        // emsesp::EMSESP::logger().info("Error configuring MQTT client");
     }
     return false;
 }
 
 void MqttSettings::read(MqttSettings & settings, JsonObject & root) {
+    root["rootCA"]        = settings.rootCA;
     root["enabled"]       = settings.enabled;
     root["host"]          = settings.host;
     root["port"]          = settings.port;
@@ -182,9 +229,11 @@ void MqttSettings::read(MqttSettings & settings, JsonObject & root) {
 }
 
 StateUpdateResult MqttSettings::update(JsonObject & root, MqttSettings & settings) {
-    MqttSettings newSettings = {};
-    bool         changed     = false;
+    MqttSettings newSettings   = {};
+    bool         changed       = false;
+    bool         restartNeeded = false;
 
+    newSettings.rootCA       = root["rootCA"] | "";
     newSettings.enabled      = root["enabled"] | FACTORY_MQTT_ENABLED;
     newSettings.host         = root["host"] | FACTORY_MQTT_HOST;
     newSettings.port         = root["port"] | FACTORY_MQTT_PORT;
@@ -300,6 +349,11 @@ StateUpdateResult MqttSettings::update(JsonObject & root, MqttSettings & setting
         emsesp::EMSESP::mqtt_.set_publish_time_heartbeat(newSettings.publish_time_heartbeat);
     }
 
+    if (newSettings.rootCA != settings.rootCA) {
+        changed       = true;
+        restartNeeded = true;
+    }
+
     // save the new settings
     settings = newSettings;
 
@@ -307,5 +361,9 @@ StateUpdateResult MqttSettings::update(JsonObject & root, MqttSettings & setting
         emsesp::EMSESP::mqtt_.reset_mqtt();
     }
 
+    if (restartNeeded) {
+        return StateUpdateResult::CHANGED_RESTART; // tell WebUI that a restart is needed
+    }
+
     return StateUpdateResult::CHANGED;
 }
diff --git a/lib/framework/MqttSettingsService.h b/lib/framework/MqttSettingsService.h
index 1db25c0d4..9b92e3f6e 100644
--- a/lib/framework/MqttSettingsService.h
+++ b/lib/framework/MqttSettingsService.h
@@ -63,6 +63,7 @@ class MqttSettings {
     bool     enabled;
     String   host;
     uint16_t port;
+    String   rootCA;
 
     // username and password
     String username;
@@ -110,7 +111,9 @@ class MqttSettingsService : public StatefulService<MqttSettings> {
     bool                                 isConnected();
     const char *                         getClientId();
     espMqttClientTypes::DisconnectReason getDisconnectReason();
-    espMqttClient *                      getMqttClient();
+    MqttClient *                         getMqttClient();
+    void                                 setWill(const char * topic);
+    void                                 onMessage(espMqttClientTypes::OnMessageCallback callback);
 
   protected:
     void onConfigUpdated();
@@ -125,6 +128,7 @@ class MqttSettingsService : public StatefulService<MqttSettings> {
     char * _retainedClientId;
     char * _retainedUsername;
     char * _retainedPassword;
+    char * _retainedRootCA;
 
     // variable to help manage connection
     bool          _reconfigureMqtt;
@@ -134,7 +138,7 @@ class MqttSettingsService : public StatefulService<MqttSettings> {
     espMqttClientTypes::DisconnectReason _disconnectReason;
 
     // the MQTT client instance
-    espMqttClient _mqttClient;
+    MqttClient * _mqttClient = nullptr;
 
     void WiFiEvent(WiFiEvent_t event, WiFiEventInfo_t info);
     void onMqttConnect(bool sessionPresent);
diff --git a/src/mqtt.cpp b/src/mqtt.cpp
index 609a82fa9..99f7c1886 100644
--- a/src/mqtt.cpp
+++ b/src/mqtt.cpp
@@ -23,7 +23,7 @@
 
 namespace emsesp {
 
-espMqttClient * Mqtt::mqttClient_;
+MqttClient * Mqtt::mqttClient_;
 
 // static parameters we make global
 std::string Mqtt::mqtt_base_;
@@ -387,9 +387,9 @@ void Mqtt::start() {
         snprintf(will_topic, MQTT_TOPIC_MAX_SIZE, "status");
     }
 
-    mqttClient_->setWill(will_topic, 1, true, "offline"); // with qos 1, retain true
+    EMSESP::esp8266React.setWill(will_topic); // with qos 1, retain true
 
-    mqttClient_->onMessage(
+    EMSESP::esp8266React.onMessage(
         [this](const espMqttClientTypes::MessageProperties & properties, const char * topic, const uint8_t * payload, size_t len, size_t index, size_t total) {
             on_message(topic, (const char *)payload, len); // receiving mqtt
         });
diff --git a/src/mqtt.h b/src/mqtt.h
index a6f54ee8d..ac3c1effe 100644
--- a/src/mqtt.h
+++ b/src/mqtt.h
@@ -111,7 +111,7 @@ class Mqtt {
 #endif
     }
 
-    static espMqttClient * client() {
+    static MqttClient * client() {
         return mqttClient_;
     }
 
@@ -229,8 +229,8 @@ class Mqtt {
   private:
     static uuid::log::Logger logger_;
 
-    static espMqttClient * mqttClient_;
-    static uint32_t        mqtt_message_id_;
+    static MqttClient * mqttClient_;
+    static uint32_t     mqtt_message_id_;
 
     static bool queue_message(const uint8_t operation, const std::string & topic, const std::string & payload, const bool retain);
     static bool queue_publish_message(const std::string & topic, const std::string & payload, const bool retain);