Index: tools/DCSsim/DCSSimController.h
===================================================================
diff -u -r59b4c22f45a1d098064a886452769204e90cfb4b -r51e99f2578e0901d9da91a4cb60d1b8858cfe971
--- tools/DCSsim/DCSSimController.h	(.../DCSSimController.h)	(revision 59b4c22f45a1d098064a886452769204e90cfb4b)
+++ tools/DCSsim/DCSSimController.h	(.../DCSSimController.h)	(revision 51e99f2578e0901d9da91a4cb60d1b8858cfe971)
@@ -15,21 +15,65 @@
 #include <QByteArray>
 #include <QObject>
 #include <QPointer>
+#include <QSslCertificate>
+#include <QSslKey>
 #include <QTcpServer>
 #include <QTcpSocket>
 
 #include "MqttPacket.h"
 
 /*!
+ * \brief   QTcpServer that upgrades accepted connections to server-side TLS.
+ * \details Plain QTcpServer while no TLS material is set. With material set,
+ *          each accepted descriptor becomes a QSslSocket and the handshake is
+ *          started before the connection is surfaced.
+ */
+class SslTcpServer : public QTcpServer
+{
+    Q_OBJECT
+
+public:
+    /*!
+     * \brief   Server-side TLS material; TLS is disabled while cert is null.
+     */
+    struct Tls
+    {
+        QSslCertificate cert;              ///< Server certificate.
+        QSslKey key;                       ///< Server private key.
+        QList<QSslCertificate> caCerts;    ///< When set, clients must present a certificate these sign (mTLS).
+    };
+
+    using QTcpServer::QTcpServer;
+
+    void setTls(const Tls &tls);
+
+protected:
+    void incomingConnection(qintptr socketDescriptor) override;
+
+private:
+    Tls _tls;
+};
+
+/*!
  * \brief   Diality Cloud System (DCS) simulator
  */
 class DCSSimController : public QObject
 {
     Q_OBJECT
 
 public:
-    explicit DCSSimController(quint16 port, QObject *parent = nullptr);
+    /*!
+     * \brief   TLS configuration, all PEM; TLS is off while certPath is empty.
+     */
+    struct TlsConfig
+    {
+        QString certPath;   ///< Server certificate.
+        QString keyPath;    ///< Server private key.
+        QString caPath;     ///< When set, clients must present a certificate this bundle signs (mTLS).
+    };
 
+    explicit DCSSimController(quint16 port, const TlsConfig &tls = {}, QObject *parent = nullptr);
+
     bool listen();
 
 private Q_SLOTS:
@@ -38,14 +82,16 @@
     void onDisconnected();
 
 private:
+    bool initTls();
     void handlePacket(const Mqtt::Packet &packet);
     void handleConnectPacket(const Mqtt::Packet &packet);
     void handlePublishPacket(const Mqtt::Packet &packet);
     void dumpPayload(const QByteArray &payload);
 
-    QTcpServer _server;
+    SslTcpServer _server;
     QPointer<QTcpSocket> _client;
     QByteArray _rxBuf;
     quint16 _port;
+    TlsConfig _tlsConfig;
     quint64 _publishCount = 0;
 };