Set up a self-hosted MQTT broker with TLS using Eclipse Mosquitto

Steps

1. Install Mosquitto on the server (apt install mosquitto on Debian/Ubuntu or equivalent); stop the default service before editing the configuration
2. Generate a CA key and self-signed certificate, then generate a server key and certificate signing request (CSR) and sign it with the CA; place the three files (ca.crt, server.crt, server.key) in a directory readable by the mosquitto user
3. Edit mosquitto.conf to add a TLS listener: set listener 8883, cafile, certfile, keyfile, and require_certificate true (for mutual TLS) or false (for server-only TLS); set allow_anonymous false and configure a password file
4. Restart Mosquitto and test with mosquitto_pub and mosquitto_sub using --cafile ca.crt (and --cert / --key for mutual TLS); verify that connecting without certificates is rejected
5. For production, replace self-signed certificates with certificates from a trusted CA or Let's Encrypt; configure certificate auto-renewal and a systemd timer to send SIGHUP to Mosquitto after renewal
6. Enable persistence (persistence true, persistence_location /var/lib/mosquitto/) and configure logging to a file for audit trails; set max_keepalive and restrict retained message size if memory is limited