MQTT communication from Edge Hub to Node-RED failing after upgrading Edge Hub from 1.5.x to 1.6.x - node-red-contrib-azure-iot-edge-module

## Description

We are using the Node-RED package:

https://github.com/iotblackbelt/noderededgemodule

Package: node-red-contrib-azure-iot-edge-module

The MQTT ModuleClient is created inside Node-RED using the Azure IoT Device SDK and MQTT transport.

Communication path:

Node-RED -> node-red-contrib-azure-iot-edge-module -> Azure IoT Device SDK MQTT ModuleClient -> Azure IoT Edge Hub

The existing implementation worked correctly with Azure IoT Edge 1.5.x.

After upgrading Azure IoT Edge Hub from 1.5.x to 1.6.x, the MQTT connection from the Node-RED module to Edge Hub fails with an authentication error.

## Working environment

Edge Agent: 1.5.43
Edge Hub: 1.5.43
Node-RED: 5.0.4
Node.js: 24.x
OPC Publisher: 2.9.17
Package: node-red-contrib-azure-iot-edge-module
Transport: MQTT

In this environment, Edge Hub -> Node-RED MQTT communication works correctly.

We also tested the following combination:

Edge Agent: 1.6.0
Edge Hub: 1.5.43
Node-RED: 5.0.4
Node.js: 24.x
Same node-red-contrib-azure-iot-edge-module
Same MQTT configuration

This combination also works correctly.

This indicates that Edge Agent 1.6.0 alone does not cause the problem.

## Failing environment

Edge Agent: 1.6.0
Edge Hub: 1.6.0
Node-RED: 5.0.4
Node.js: 24.x
OPC Publisher: 2.9.17
Package: node-red-contrib-azure-iot-edge-module
Transport: MQTT

The Node-RED container is running and the Node-RED editor is accessible.

However, the MQTT ModuleClient inside Node-RED fails while establishing the connection to Edge Hub.

## Error

Node-RED reports:

Module Client created.

Module Client open error:
UnauthorizedError: mqtt.js returned Failure on first connection (Not authorized): Unable to establish a connection error

The stack trace shows the failure occurring through the MQTT implementation:

UnauthorizedError: mqtt.js returned Failure on first connection (Not authorized): Unable to establish a connection error
at translateError (.../azure-iot-mqtt-base/dist/mqtt_translate_error.js:71:19)
at constructor._onEnter (.../azure-iot-device-mqtt/dist/mqtt.js:85:95)
at constructor.transition (.../machina/lib/machina.js:653:28)
at Fsm. [as transition] (.../machina/lib/machina.js:466:63)
at .../azure-iot-device-mqtt/dist/mqtt.js:224:59
at constructor._onEnter (.../azure-iot-mqtt-base/dist/mqtt_base.js:146:29)
at constructor.transition (.../machina/lib/machina.js:653:28)
at Fsm. [as transition] (.../machina/lib/machina.js:466:63)
at .../azure-iot-mqtt-base/dist/mqtt_base.js:225:39
at .../mqtt/lib/client.js:988:11

The failure occurs during the first MQTT connection attempt.

## Important isolation result

Test 1:

Edge Agent 1.5.43 + Edge Hub 1.5.43
Result: Working

Test 2:

Edge Agent 1.6.0 + Edge Hub 1.5.43
Result: Working

Test 3:

Edge Agent 1.6.0 + Edge Hub 1.6.0
Result: Failing with MQTT authentication error

Therefore, based on our testing, the problem appears to be specifically related to Edge Hub 1.6.x rather than Edge Agent 1.6.x.

## Edge Hub observation

Edge Hub 1.6.0 starts the MQTT protocol head successfully:

Starting protocol heads - (MQTT, AMQP, HTTP)
Starting MQTT head
Initializing TLS endpoint on port 8883 for MQTT head.
Started MQTT head

Therefore, the MQTT protocol head is running, but the Node-RED MQTT ModuleClient is rejected with:

(Not authorized)

## Original package implementation

The original package uses the Azure IoT Device SDK MQTT transport:

var Transport = require('azure-iot-device-mqtt').Mqtt;
var Client = require('azure-iot-device').ModuleClient;

Client.fromEnvironment(Transport, function (err, client) {
...
});

Original dependencies include:

azure-iot-device: ^1.17.1
azure-iot-device-mqtt: ^1.15.1

Repository:

https://github.com/iotblackbelt/noderededgemodule

## Expected behavior

An existing Node.js Node-RED module using ModuleClient.fromEnvironment(Mqtt) should be able to authenticate with Edge Hub 1.6.x, establish the MQTT connection, subscribe to module inputs, and receive messages from Edge Hub as it does with Edge Hub 1.5.x.

## Actual behavior

With Edge Hub 1.6.x:

1. Node-RED starts normally.
2. node-red-contrib-azure-iot-edge-module loads.
3. The MQTT ModuleClient is created successfully.
4. The MQTT connection attempt fails.
5. The MQTT client returns UnauthorizedError / Not authorized.
6. The Node-RED module cannot establish the required MQTT communication with Edge Hub.
7. Messages routed from Edge Hub to Node-RED are not received.

## Questions

Could there be a breaking or compatibility change in Edge Hub 1.6.x affecting MQTT authentication for Node.js modules using azure-iot-device-mqtt?

Specifically:

1. Were there changes to the Edge Hub 1.6 MQTT protocol head or module authentication?
2. Were there changes to MQTT TLS, certificates, SAS authentication, or module identity handling?
3. Is azure-iot-device-mqtt still supported for modules connecting to Edge Hub 1.6.x?
4. Is a newer Azure IoT Device SDK required?
5. Are there known compatibility issues with Node.js 24.x and azure-iot-device-mqtt?
6. Is there a recommended migration path for existing applications using ModuleClient.fromEnvironment(Mqtt)?

## Summary

Edge Agent 1.6.0 with Edge Hub 1.5.43 works.

Edge Agent 1.6.0 with Edge Hub 1.6.0 fails.

The failure is an MQTT authentication error from the MQTT ModuleClient running inside Node-RED:

UnauthorizedError: mqtt.js returned Failure on first connection (Not authorized)

We would appreciate guidance on what changed in Edge Hub 1.6.x and what SDK, authentication, or configuration changes are required for existing Node.js MQTT ModuleClient applications to communicate with Edge Hub 1.6.x.

Start by reproducing the failure with the listed Edge Agent and Edge Hub versions, then inspect ModuleClient.fromEnvironment(Mqtt) and the MQTT protocol head involved in the reported stack trace. Compare the working Edge Hub 1.5.43 setup with 1.6.0, including authentication and TLS behavior. Done means identifying the compatibility change or required configuration or SDK update and documenting a verified working connection.

Written by the indexing model from the issue text.