Setting up Mosquitto with SSL

Question

I'm trying to set-up Mosquitto with SSL on my Raspberry Pi 3. I followed this tutorial

Now my mosquitto.conf is:

listener 8883
cafile /etc/mosquitto/certs/mosq-ca.crt
certfile /etc/mosquitto/certs/mosq-serv.crt
keyfile /etc/mosquitto/certs/mosq-serv.key

But when I run the commend:

mosquitto_sub -t "#" -v --cafile /etc/mosquitto/certs/mosq-ca.crt -p 8883

I get:

Error: connection refused

I have deleted the /etc/mosquitto/conf.d/mosquitto.conf. The file is now empty. The default mosquitto.conf now is:

pid_file /var/run/mosquitto.pid 
persistence true persistence_location /var/lib/mosquitto/ 
log_dest file /var/log/mosquitto/mosquitto.log 
include_dir /etc/mosquitto/conf.d 
listener 8883 
cafile /etc/mosquitto/certs/mosq-ca.crt 
certfile /etc/mosquitto/certs/mosq-serv.crt 
keyfile /etc/mosquitto/certs/mosq-serv.key 

But I still receive

Error: connection refused

What did I do wrong or what did I forget to do?

When i use ( i wont listen on port 8883) sudo mosquitto -v:

1514921332: mosquitto version 1.4.10 (build date Mon, 29 May 2017 13:43:29 +0100) starting
1514921332: Using default config.
1514921332: Opening ipv4 listen socket on port 1883.
1514921332: Opening ipv6 listen socket on port 1883.

My /var/log/mosquitto/mosquitto.log log:

 1514932164: Config loaded from /etc/mosquitto/mosquitto.conf.
    1514932164: Opening ipv4 listen socket on port 8883.
    1514932164: Opening ipv6 listen socket on port 8883.
    1514932373: Error in poll: Interrupted system call.
    1514932373: mosquitto version 1.4.10 terminating
    1514932378: mosquitto version 1.4.10 (build date Mon, 29 May 2017 13:43:29 +010$

The Error has thanged to: Error: A TLS error occurred.

Answer 1

As has been suggested in the comments (and now verified by log output) your mosquitto.conf file is not being used.

You need to specify the config file when starting the broker with the -c command line argument.

mosquitto -c /etc/mosquitto/mosquitto.conf

Mosquitto will NOT default to the /etc/mosquitto/mosquitto.conf, if no file is passed it will only listen on port 1883 with no SSL.

If you are starting the broker as a service at startup then you need to check the /etc/init.d/mosquitto script to ensure it is passing the config file to mosquitto when it starts.

Answer 2

mosquitto -c /etc/mosquitto/mosquitto.conf

This should work Seeing what you are doing, I believe you will use the server.crt and server.key to authenticate Login I guess ? Then you would need need another line in the mosquitto.conf ie.

require_certificate which when set to be true will ask the incoming clients to provide certificates