title: How do I set up TLS on a mosquitto (MQTT) broker?
body: <p>I got mosquitto working, using plain old TCP but i want to secure it using SSL and TLS, so i followed the following guide to create the certificates for my mosquitto broker:</p>
  
  <p><a href="https://mosquitto.org/man/mosquitto-tls-7.html" rel="nofollow">https://mosquitto.org/man/mosquitto-tls-7.html</a></p>
  
  <p>Then I added the following lines to the config file:</p>
  
  <pre><code>listener 8883
  cafile /mqtt/certs/ca.crt
  certfile /mqtt/certs/server.crt
  keyfile /mqtt/certs/server.key
  require_certificate false
  </code></pre>
  
  <p>But now when i try to use mosquitto_sub on another machine to try to connect to the mosquitto broker over port 8883 (TLS), i get the following error on the broker</p>
  
  <pre><code>New connection from XX.XXX.XXX.XXX on port 8883.
  OpenSSL Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
  OpenSSL Error: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure
  Socket error on client &lt;unknown&gt;, disconnecting.
  </code></pre>
  
  <p>I've tried doing the mosquitto_sub the following ways:</p>
  
  <pre><code>$ mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883
  $ mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883 --cafile ca.crt
  $ mosquitto_sub -h "HOST_HERE.com" -t "sup" -p 8883 --cafile ca.crt --cert client.crt --key client.key
  </code></pre>
  
  <p>And the certificates on the client side were generated based on the first link i mentioned earlier.</p>
  
  <p>Anyone know why this is happening and how I can go about fixing it?</p>