MOSQUITTO-TLS(7)

💖 MOSQUITTO-TLS 💖

ok bestie, welcome to the mosquitto-tls(7) glow-up ✨ this is a manual page from the Conventions and miscellaneous corner of the Mosquitto world, and it's literally all about getting SSL/TLS set up so your connections are encrypted and your clients can actually authenticate. no cap, it's giving "secure or nothing." 🎀

🌸 NAME 🌸

mosquitto-tls — configure SSL/TLS support for Mosquitto, aka make your broker's connections encrypted and authenticated 🔥

✨ DESCRIPTION ✨

so basically mosquitto ships with SSL support for encrypted network connections and authentication, and this manual is the whole "how do I actually create the files I need" arc. main character energy from start to finish 💅

🚨 Note, and please actually read this one: it is important to use different certificate subject parameters for your CA, your server, and your clients. If the certificates end up looking identical — even if you generated them separately, bestie, even if you swear you did — the broker/client will not be able to tell them apart, and you'll get errors that are genuinely difficult to diagnose. like, crying-in-the-group-chat levels of confusing 😭

---

🦋 GENERATING CERTIFICATES 🦋

the sections below hand you the openssl commands you can use to generate certificates, but with no context — just the raw commands, no vibes attached. if you want the full run-through of how to use them, there's an asciicast here: https://asciinema.org/a/201826 — go watch it, it's the tutorial arc 🍓

👑 CERTIFICATE AUTHORITY

first up: generate a certificate authority certificate and key. this is the parent of the whole operation.

• openssl req -new -x509 -days <duration> -extensions v3_ca -keyout ca.key -out ca.crt

🔥 SERVER

generate a server key:

• openssl genrsa -aes256 -out server.key 2048

then generate a certificate signing request to send to the CA:

• openssl req -out server.csr -key server.key -new

🙈 Note: when it prompts you for the CN (Common Name), please enter either your server (or broker) hostname or domain name. that's the whole assignment, don't overthink it 💜

now send that CSR to the CA, or just sign it yourself with your CA key:

• openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days <duration>

🧚 CLIENT

same energy, client edition. generate a client key:

• openssl genrsa -aes256 -out client.key 2048

generate a certificate signing request to send to the CA:

• openssl req -out client.csr -key client.key -new

send the CSR to the CA, or sign it with your CA key:

• openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days <duration>

and that's the trifecta — CA, server, client — all signed and ready to slay 🌈

---

⭐ SEE ALSO ⭐

go read these next, iykyk:

• mosquitto(7)
• mosquitto(8)
• mosquitto.conf(5)

🫶 AUTHOR 🫶

Roger Light <roger@atchoo.org> — the icon who made all of this happen 👑

---

and that's the page, bestie 🎀 this was MOSQUITTO-TLS(7) from the Mosquitto Project, dated 02/09/2026 — go forth and encrypt, fr fr 💖✨