How do you set up encrypted mosquitto broker like a webpage which has https?

Question

I\'m trying to setup a mosquitto broker which is encrypted using ssl/tls. I don\'t want to generate client certificates. I just want an encrypted connection.

The ma

Answer 1

To secure WebSocket access of Mosquitto, e.g. using a Let's Encrypt certificate, your config file could look like this:

listener 9001
protocol websockets
certfile /etc/letsencrypt/live/yourdomain.com/cert.pem
cafile /etc/letsencrypt/live/yourdomain.com/chain.pem
keyfile /etc/letsencrypt/live/yourdomain.com/privkey.pem

Make sure that the files are readable by Mosquitto (Debian in particular runs Mosquitto under the mosquitto user, which is unprivileged). You need Mosquitto 1.4 to support WebSockets.

To connect to this WebSocket using the Paho JavaScript client:

// host and port overwritten at connect
var mqtt = new Paho.MQTT.Client("yourdomain.com", 9001, "");   

mqtt.connect({
    hosts: [ "wss://yourdomain.com:9001/" ],
    useSSL: true
});

Note that this does not imply any access control yet, so your MQTT broker will be publicly accessible. You may want to add authorization, too.