diff --git a/.cargo/audit.toml b/.cargo/audit.toml
new file mode 100644
index 0000000..089137b
--- /dev/null
+++ b/.cargo/audit.toml
@@ -0,0 +1,13 @@
+# Avisos aceptados de forma explícita. Todos llegan por rumqttc 0.25.1 (la última versión publicada), que fija
+# rustls-webpki 0.102 y rustls-pemfile 2. rumqttc usa rustls-webpki solo como tipo de error: el simulador verifica los
+# certificados con su propio ClientConfig de rustls 0.23, que usa rustls-webpki 0.103.16 (con los arreglos), y lee
+# el PEM con rustls::pki_types. Quitar esta lista cuando rumqttc publique una versión con rustls-webpki 0.103.
+[advisories]
+ignore = [
+    "RUSTSEC-2026-0098", # rustls-webpki 0.102: restricciones de nombre para URI
+    "RUSTSEC-2026-0099", # rustls-webpki 0.102: restricciones de nombre con comodines
+    "RUSTSEC-2026-0382", # rustls-webpki 0.102: intermedios no confiables
+    "RUSTSEC-2026-0049", # rustls-webpki 0.102: CRL por punto de distribución
+    "RUSTSEC-2026-0104", # rustls-webpki 0.102: panic al leer CRL
+    "RUSTSEC-2025-0134", # rustls-pemfile: sin mantenimiento
+]
diff --git a/Cargo.lock b/Cargo.lock
index 114822f..23748f9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -218,16 +218,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "core-foundation"
-version = "0.9.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
-dependencies = [
- "core-foundation-sys",
- "libc",
-]
-
 [[package]]
 name = "core-foundation"
 version = "0.10.1"
@@ -759,12 +749,6 @@ version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
-[[package]]
-name = "openssl-probe"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.2"
@@ -1077,7 +1061,7 @@ dependencies = [
  "flume",
  "futures-util",
  "log",
- "rustls-native-certs 0.8.5",
+ "rustls-native-certs",
  "rustls-pemfile",
  "rustls-webpki 0.102.8",
  "thiserror",
@@ -1109,29 +1093,16 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-native-certs"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
-dependencies = [
- "openssl-probe 0.1.6",
- "rustls-pemfile",
- "rustls-pki-types",
- "schannel",
- "security-framework 2.11.1",
-]
-
 [[package]]
 name = "rustls-native-certs"
 version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a073f5dc7469f984c52ad2752b63b0807745133b6de880b7b64c1ac4c48aec4"
 dependencies = [
- "openssl-probe 0.2.2",
+ "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.7.0",
+ "security-framework",
 ]
 
 [[package]]
@@ -1203,19 +1174,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "security-framework"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
-dependencies = [
- "bitflags",
- "core-foundation 0.9.4",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -1223,7 +1181,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags",
- "core-foundation 0.10.1",
+ "core-foundation",
  "core-foundation-sys",
  "libc",
  "security-framework-sys",
@@ -1354,8 +1312,7 @@ dependencies = [
  "regex",
  "reqwest",
  "rumqttc",
- "rustls-native-certs 0.7.3",
- "rustls-pemfile",
+ "rustls-native-certs",
  "serde",
  "serde_json",
  "subtle",
diff --git a/Cargo.toml b/Cargo.toml
index 8567b65..d3db82c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -12,8 +12,7 @@ axum = { version = "0.8", features = ["macros"] }
 tower = { version = "0.5", features = ["util"] }
 tower-http = { version = "0.7", features = ["trace", "cors"] }
 rumqttc = "0.25"
-rustls-pemfile = "2.2"
-rustls-native-certs = "0.7"
+rustls-native-certs = "0.8"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
diff --git a/src/device.rs b/src/device.rs
index 1fb8d21..3b281c1 100644
--- a/src/device.rs
+++ b/src/device.rs
@@ -120,17 +120,20 @@ impl SimulatedDevice {
         ));
 
         if settings.tls {
+            // La verificación la hace rustls 0.23; el PEM se lee con pki-types (rustls-pemfile ya no se mantiene).
+            use rumqttc::tokio_rustls::rustls::pki_types::{pem::PemObject, CertificateDer};
             let mut root_cert_store = rumqttc::tokio_rustls::rustls::RootCertStore::empty();
             if let Some(ref ca_file) = settings.ca_file {
-                if let Ok(file) = std::fs::File::open(ca_file) {
-                    let mut reader = std::io::BufReader::new(file);
-                    let certs = rustls_pemfile::certs(&mut reader).flatten();
-                    for cert in certs {
-                        let _ = root_cert_store.add(cert);
+                match CertificateDer::pem_file_iter(ca_file) {
+                    Ok(certs) => {
+                        for cert in certs.flatten() {
+                            let _ = root_cert_store.add(cert);
+                        }
                     }
+                    Err(error) => warn!("No se pudo leer la CA {}: {}", ca_file, error),
                 }
             } else {
-                for cert in rustls_native_certs::load_native_certs().unwrap_or_default() {
+                for cert in rustls_native_certs::load_native_certs().certs {
                     let _ = root_cert_store.add(cert);
                 }
             }