title: Mosquitto configuration for Websockets + TLS
body: <p>I've been using mosquitto + websockets on debian 8 since a while, with great results. Now I'd like to move the system to pre-production, so I need to start encrypting these communications.</p>
  
  <p>I have tried generating the certificates by hand, following the steps found on this blog post (<a href="http://embeddedprog.blogspot.pt/2014/05/tlsssl-communication-via-mqtt.html" rel="nofollow">http://embeddedprog.blogspot.pt/2014/05/tlsssl-communication-via-mqtt.html</a>) and with the certificate generation script from J-P Mens (<a href="https://github.com/owntracks/tools" rel="nofollow">https://github.com/owntracks/tools</a>)</p>
  
  <p>My "mosquitto.conf" looks like this:</p>
  
  <pre><code>allow_anonymous false
  allow_duplicate_messages false
  autosave_interval 1800
  persistence true
  persistence_file mosquitto.db
  persistence_location /tmp/
  connection_messages true
  log_timestamp true
  #log_dest syslog
  
  #log_type error
  #log_type warning
  #log_type notice
  #log_type information
  log_type all
  log_type debug
  
  
  listener 8880
  protocol mqtt
  
  listener 8881
  protocol websockets
  bind_address hi-server
  cafile /home/hi/cert/ca.crt
  certfile /home/hi/cert/hi.com.crt
  keyfile /home/hi/cert/hi.com.key
  tls_version tlsv1
  #require_certificate false
  
  #
  #   __  __       ____   ___  _
  #  |  \/  |_   _/ ___| / _ \| |
  #  | |\/| | | | \___ \| | | | |
  #  | |  | | |_| |___) | |_| | |___
  #  |_|  |_|\__, |____/ \__\_\_____|
  #          |___/
  #
  #
  
  #auth_plugin /home/jpm/mosquitto-auth-plug/auth-plug.so
  auth_plugin /etc/mosquitto/auth-plug.so
  [auth_opt stuff...]
  </code></pre>
  
  <p>And this is the mosquitto verbose output:</p>
  
  <pre><code>1448802719: mosquitto version 1.4.2 (build date 2015-11-27 23:40:02+0000) starting
  1448802719: Config loaded from /etc/mosquitto/mosquitto.conf.
  1448802719: |-- *** auth-plug: startup
  1448802719: |-- ** Configured order: mysql
  
  1448802719: |-- }}}} MYSQL
  1448802719: Opening ipv4 listen socket on port 8880.
  1448802719: Opening ipv6 listen socket on port 8880.
  1448802719: Opening websockets listen socket on port 8881.
  1448802719: New connection from ****** on port 8880.
  1448802719: |-- mosquitto_auth_unpwd_check(******)
  1448802719: |-- ** checking backend mysql
  1448802719: |-- getuser(******) AUTHENTICATED=1 by mysql
  1448802719: New client connected from ****** as ****** (c1, k15, u'******').
  1448802719: Sending CONNACK to ****** (0, 0)
  </code></pre>
  
  <p>Whenever I try connecting with the HiveMQ Websockets Client it does a timeout...</p>
  
  <p>Can someone give me an indication of how to achieve this? Help would be much appreciated!</p>
  
  <p>Thanks,
  Pedro.</p>
  
  <p><strong>UPDATE: managed to connect by importing CA certificate</strong></p>
  
  <p>I have since managed to connect to mosquito using the Paho MQTT client for javascript! I made slight changes to <em>mosquitto.conf</em>:</p>
  
  <pre><code>listener 8880
  protocol mqtt
  
  listener 8881
  protocol websockets
  cafile /home/hi/cert/ca.crt
  certfile /home/hi/cert/hi.com.crt
  keyfile /home/hi/cert/hi.com.key
  tls_version tlsv1
  #require_certificate false
  </code></pre>
  
  <p>The issue I have now is that I'm only able to connect if I have imported the <em>hi.com.crt</em> file and manually set to "Always Trust" on keychain (OS X). Since the certificate is self-signed and not trusted by iOS i can't login using my iPhone...</p>
  
  <p>Shouldn't the default mosquitto TLS behavior be NOT to require the certificate from the client side?</p>