Index: tools/DCSsim/main.cpp
===================================================================
diff -u -r59b4c22f45a1d098064a886452769204e90cfb4b -r51e99f2578e0901d9da91a4cb60d1b8858cfe971
--- tools/DCSsim/main.cpp	(.../main.cpp)	(revision 59b4c22f45a1d098064a886452769204e90cfb4b)
+++ tools/DCSsim/main.cpp	(.../main.cpp)	(revision 51e99f2578e0901d9da91a4cb60d1b8858cfe971)
@@ -29,7 +29,13 @@
 
     QCommandLineOption portOption(QStringList() << "p" << "port",
         "TCP listening port", "port", QString::number(DEFAULT_MQTT_PORT));
+    QCommandLineOption certOption("cert", "Server certificate PEM; enables TLS (requires --key).", "file");
+    QCommandLineOption keyOption("key", "Server private key PEM.", "file");
+    QCommandLineOption caOption("ca", "CA bundle PEM; clients must present a certificate it signs (mTLS).", "file");
     parser.addOption(portOption);
+    parser.addOption(certOption);
+    parser.addOption(keyOption);
+    parser.addOption(caOption);
     parser.process(app);
 
     bool ok = false;
@@ -39,7 +45,21 @@
         return 1;
     }
 
-    DCSSimController simController(static_cast<quint16>(port));
+    if (parser.isSet(certOption) != parser.isSet(keyOption)) {
+        qCritical().noquote() << "DCSsim: --cert and --key must be given together";
+        return 1;
+    }
+    if (parser.isSet(caOption) && !parser.isSet(certOption)) {
+        qCritical().noquote() << "DCSsim: --ca requires --cert and --key";
+        return 1;
+    }
+
+    DCSSimController::TlsConfig tls;
+    tls.certPath = parser.value(certOption);
+    tls.keyPath  = parser.value(keyOption);
+    tls.caPath   = parser.value(caOption);
+
+    DCSSimController simController(static_cast<quint16>(port), tls);
     if (!simController.listen()) {
         return 1;
     }