Kevin, no: the broker needs SNI, so you have to connect by host name, and the certificate check is against that name too. IP is a dead end.
The clue is that the tech’s static config included 8.8.8.8. rc=-2 in PubSubClient is „connect failed“, which on an 8266 is very often a failed name lookup. I’ve seen this on plant networks a few times: the DHCP server hands out the plant’s internal DNS server, and that one only answers for internal names, or blocks outside lookups. With static config the board used 8.8.8.8 instead and everything worked. Add this after connecting and you’ll see it:
Serial.println(WiFi.dnsIP());
IPAddress ip;
Serial.println(WiFi.hostByName(MQTT_HOST, ip) ? ip.toString() : "lookup failed");Then ask IT for one of two things: let their DNS resolve your organisation’s broker host name (it’s on the device’s Connection details card), or allow outbound DNS from that VLAN. And while you’re talking to them, outbound TCP 8883 has to be open as well, plus 443 if you ever use HTTPS. Wilson’s guess is worth guarding against anyway: wait for WiFi.localIP() to be non-zero before the first connect.