MOSQUITTO-TLS(7) Conventions and miscellaneous MOSQUITTO-TLS(7)

.SH "NAME" mosquitto-tls - Configure SSL/TLS support for Mosquitto

.SH "DESCRIPTION"

.PP **mosquitto** provides SSL support for encrypted network connections and authentication. This manual describes how to create the files needed.

.if n .sp

**Note**

It is important to use different certificate subject parameters for your CA, server and clients. If the certificates appear identical, even though generated separately, the broker/client will not be able to distinguish between them and you will experience difficult to diagnose errors.

.SH "GENERATING CERTIFICATES"

.PP The sections below give the openssl commands that can be used to generate certificates, but without any context. The asciicast at **https://asciinema.org/a/201826** gives a full run through of how to use those commands.

.SH "CERTIFICATE AUTHORITY"

.PP Generate a certificate authority certificate and key.

•openssl req -new -x509 -days <duration> -extensions v3\_ca -keyout ca.key -out ca.crt

.SH "SERVER"

.PP Generate a server key.

•openssl genrsa -aes256 -out server.key 2048

.PP Generate a certificate signing request to send to the CA.

•openssl req -out server.csr -key server.key -new

.if n .sp

**Note**

When prompted for the CN (Common Name), please enter either your server (or broker) hostname or domain name.

.PP Send the CSR to the CA, or sign it with your CA key:

•openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days <duration>

.SH "CLIENT"

.PP Generate a client key.

•openssl genrsa -aes256 -out client.key 2048

.PP Generate a certificate signing request to send to the CA.

•openssl req -out client.csr -key client.key -new

.PP Send the CSR to the CA, or sign it with your CA key:

•openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days <duration>

.SH "SEE ALSO"

[**mosquitto**(7)](/man/os/mosquitto/mosquitto.7), [**mosquitto**(8)](/man/os/mosquitto/mosquitto.8), [**mosquitto.conf**(5)](/man/os/mosquitto/mosquitto.conf.5)

.SH "AUTHOR"

.PP Roger Light <roger@atchoo.org>

10/13/2026 Mosquitto Project

---

Document: mosquitto-tls(7) from mosquitto 2.1.2-r7 (Chainguard OS)
Source: https://github.com/eclipse/mosquitto