# Support for passing custom SSLContext or single-alias filtering in Android HiveMQ Client

**URL:** <https://community.hivemq.com/t/support-for-passing-custom-sslcontext-or-single-alias-filtering-in-android-hivemq-client/4075>\
**Category:** Uncategorized\
**Created:** [September 24, 2026, 4:58am UTC](https://community.hivemq.com/t/support-for-passing-custom-sslcontext-or-single-alias-filtering-in-android-hivemq-client/4075 "2026-09-24T04:58:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![akshay.harale](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@akshay.harale](https://community.hivemq.com/u/akshay.harale)\
**Post date:** [September 24, 2026, 4:58am UTC](https://community.hivemq.com/t/support-for-passing-custom-sslcontext-or-single-alias-filtering-in-android-hivemq-client/4075/1 "2026-09-24T04:58:51Z")

</div>

**Hi HiveMQ Team,**

We are using the HiveMQ Android MQTT Client and need guidance on configuring TLS client authentication and certificate trust scoping.

#### **Current Issue:**

Our application maintains a `KeyStore` containing **4 different certificates** used for various services within our app. One of these certificates is dedicated specifically to the MQTT broker for mTLS.

When we initialize `MqttClientSslConfig` using `TrustManagerFactory` and `KeyManagerFactory`, the default Java / Android implementation evaluates all certificates in the `KeyStore` rather than selecting the specific certificate intended for the MQTT connection. As a result, the TLS layer attempts to negotiate using one of the other certificates, causing handshake failures.

---

<div class="post-metadata">

**Author:** ![hivemq-support](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.hivemq.com/hivemq-support/32/357_2.png) [@hivemq-support](https://community.hivemq.com/u/hivemq-support)\
**Post date:** [September 24, 2026, 4:39pm UTC](https://community.hivemq.com/t/support-for-passing-custom-sslcontext-or-single-alias-filtering-in-android-hivemq-client/4075/2 "2026-09-24T16:39:41Z")

</div>

Hello Akshay,

Thanks for reaching out on our HiveMQ Community Forum.

The keystore doesn’t need to contain only one certificate. However, because your application contains multiple client certificates, the Android TLS implementation may select an unintended certificate during the handshake.  
As a workaround, we recommend creating a dedicated keystore containing only the MQTT client certificate and its corresponding private key. This ensures that the correct certificate is presented to the broker and is the simplest way to avoid certificate-selection ambiguity.  
The truststore can still contain the required server or CA certificates separately. If you need to retain multiple client certificates in one keystore, the application must explicitly select the MQTT certificate alias through a custom `X509KeyManager`, provided this is supported by your implementation.

Please also verify that the MQTT certificate includes the `clientAuth` extended key usage and that its issuing CA is trusted by the broker.

Regards,  
Gil