title: mosquitto-clients and broker running on SSL
body: <p>I've managed to setup a broker using SSL using Let's Encrypt certs.</p>
  
  <p>I've tried testing a websockets client connecting to <code>wss://broker:9002/mqtt</code>, and it's working. I've also tried using <code>mqtt.js</code> command-line interface to subscribe to a topic on the broker <code>mqtts://broker:8883/mqtt</code> successfully.</p>
  
  <p>However, I can't get <code>mosquitto_sub</code> and <code>mosquitto_pub</code> to work. 
  I tried with,</p>
  
  <pre><code>$ mosquitto_sub -h www.my-host.com.ar -p 8883 -t hello -d --cafile fullchain.pem
  Client mosqsub/21069-atlantis sending CONNECT
  Error: A TLS error occurred.
  </code></pre>
  
  <p>where fullchain.pem is the same ca cert that's on the server.</p>
  
  <p>The mosquitto.log's broker shows,</p>
  
  <pre><code>1456709201: OpenSSL Error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca
  1456709201: OpenSSL Error: error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure
  1456709201: Socket error on client &lt;unknown&gt;, disconnecting.
  1456709206: New connection from &lt;my-ip&gt; on port 8883.
  </code></pre>
  
  <p>What could be happening? I didn't provide any cert for <code>mqtt.js</code> lib...</p>
  
  <p>This is my broker conf (splitted in two files),</p>
  
  <pre><code>#################################
  # /etc/mosquitto/mosquitto.conf #
  #################################
  pid_file /var/run/mosquitto.pid
  
  persistence true
  persistence_location /var/lib/mosquitto/
  
  log_dest file /var/log/mosquitto/mosquitto.log
  
  listener 1883
  
  listener 8883
  cafile /etc/letsencrypt/live/www.my-host.com.ar/fullchain.pem
  certfile /etc/letsencrypt/live/www.my-host.com.ar/cert.pem
  keyfile /etc/letsencrypt/live/www.my-host.com.ar/privkey.pem
  
  include_dir /etc/mosquitto/conf.d
  
  #############################################
  # /etc/mosquitto/conf.d/websockets_ssl.conf #
  #############################################
  listener 9002
  protocol websockets
  cafile /etc/letsencrypt/live/www.my-host.com.ar/fullchain.pem
  certfile /etc/letsencrypt/live/www.my-host.com.ar/cert.pem
  keyfile /etc/letsencrypt/live/www.my-host.com.ar/privkey.pem
  </code></pre>