This is a good tutorial to get the server side of things secured. I didn't know you could use Traefik to proxy the MQTT connections as well which looks quite useful.

The biggest issue I have is with the client side and its various support of TLS and getting a trusted CA certificate distributed. This is the harder part of the equation in my opinion, support is getting better with firmwares like Tasmota but getting some third party IoT device to work over TLS is still a challenge.