I managed to get Traefik to proxy the broker and have a letsencrypt public cert for MQ on port 8883 and have it validate client certs using the root.pem cert that gets generated at install time