Re: [mosquitto-dev] Setting up TLS

[Jan-Piet Mens <jpmens.dns@xxxxxxxxx>]

> In mosquitto.conf am I right in setting:
>    cafile  ca.crt
>    certfile  server.crt
>    keyfile  server.key

That's correct.

> On the client, is it server.crt which needs to be used in the --cafile
> parameter to _pub/_sub?

No. The --cafile option expects the CA certificate, so --cafile ca.crt
as per the names used above.

> I'm working without client certificates to begin with - though similar
> questions might arise when I enable this too!

When you enable client certificates you'll have to adjust Mosquitto's
configuration to request them, and your clients will need --cert and
--key with the client certificate and client key respectively.

        -JP