OPC UA PubSub over TLS: can the message broker still read the payload?

Separate transport protection from protection of the message itself. TLS protects each connection, but a broker terminating those connections can generally access the payload. The OPC UA specification distinguishes this from publisher-to-subscriber message security.

PubSub message security can provide signing or signing with encryption using keys shared within the configured SecurityGroup. Review the actual message mapping, implementation support and key-distribution arrangement. Selecting an encrypted transport alone does not establish that message-level protection is enabled.

Document who is trusted to read and publish each dataset, then test the deployed configuration against that boundary. Include broker credentials, topic authorization and key rotation. Transport and message security can be used together because they address different parts of the communication path.