How to secure mosquitto on windows

What you will learn here  about mosquitto or mqtt SSL or TLS certificate

• How  to secure mosquitto on windows

You have tried configuring mosquitto or MQTT broker with SSL or TLS certificate but all attempt failed. So don’t worry here we will see how to configure mosquitto with SSL or TLS certificate.

First you need a broker. Please visit the following link to install MQTT broker on Windows

Installing MQTT Broker on Windows

Open SSL Setup installation

Here first we will see install  how to install open SSL which will help us creating SSL Certificates.

1)Please click on the following link to download the OpenSSL

2)Once download is complete please unzip the downloaded folder and please keep in C directory of your system

Generate SSL certificate using OpenSSL

Please follow the following steps to generate SSL or TLS certificate using OpenSSL for MQTT broker.

1)Please Open command prompt in Administrator mode

2)Now please navigate to bin folder OpenSSL from command using following command which is shown below

cd C:\OpenSSL\bin

3)Create CA key pair

openssl genrsa -des3 -out mqtt_ca.key 2048

4)Create CA certificate

Please enter following things

Country Name – Enter first two letters  of your country

State Name – Enter your state name

Locality Name – Enter your local area name

Organization Name – enter your company name or any other name

Organization Unit Name – Enter sector name

Common Name – Enter name for your client. I have entered joker. you can enter anything

openssl req -new -x509 -days 3650 -key mqtt_ca.key -out mqtt_ca.crt

5)Create Server key pair

openssl genrsa -out mqtt_srv.key 2048

6)Create certificate request from CA

Please enter following things

Country Name – Enter first two letters  of your country

State Name – Enter your state name

Locality Name – Enter your local area name

Organization Name – enter your company name or any other name

Organization Unit Name – Enter sector name

Common Name – Enter name for your server. This is your server DNS name so that others can connect it. Below I have entered localhost.

Challenge password – Enter new password

openssl req -new -out mqtt_srv.csr -key mqtt_srv.key

7)Verify and sign the Certificate request

openssl x509 -req -in mqtt_srv.csr -CA mqtt_ca.crt -CAkey mqtt_ca.key -CAcreateserial -out mqtt_srv.crt -days 3650

8)Your generated SSL or TLS certificates are available C:\OpenSSL\bin directory

9)To check generated SSL are correct or not please execute the following command

openssl verify -CAfile m2mqtt_ca.crt m2mqtt_srv.crt

If you are getting OK as response means Generated SSL Certificates are correct.

How to secure mosquitto on windows

Please follow the following steps to know how to secure mosquitto on windows

1)Assuming you have followed above steps and generated SSL certifcates

2)Now please create  cert folder in your mosquitto directory

3)Now please copy paste the following cerficate from C:\OpenSSL\bin to C:\Program Files (x86)\mosquitto\certs which is shown below

1. mqtt_ca.crt
2. mqtt_srv.crt
3. mqtt_srv.key

4)Now please add the following lines in mosquitto.conf file and save the file which is shown below

listener 8883
protocol mqtt
require_certificate false
allow_anonymous true

cafile C:\Program Files (x86)\mosquitto\certs\mqtt_ca.crt
certfile C:\Program Files (x86)\mosquitto\certs\mqtt_srv.crt
keyfile C:\Program Files (x86)\mosquitto\certs\mqtt_srv.key
tls_version tlsv1.1

5)Now we need to restart the MQTT Broker. So please execute the following command to stop the MQTT broker

net stop mosquitto

6)Now please execute the following command to start the MQTT broker

net start mosquitto

7)Now please navigate to your mosquitto installed folder

cd C:\Program Files (x86)\mosquitto\

8)Please execute the following command to check mosquitto is listening on 8883 (SSL port)

mosquitto -c mosquitto.conf -v

Test mosquitto /MQTT with SSL Certificate

1)Assuming you have followed above all steps

2)Now please execute the following command to subscribe the data which is shown below

mosquitto_sub -t test -h localhost --cafile "C:\Program Files (x86)\mosquitto\certs\mqtt_ca.crt"

3)Now please execute the following command to publish the data which is shown below

mosquitto_sub -t test -h localhost -m hi --cafile "C:\Program Files (x86)\mosquitto\certs\mqtt_ca.crt"

4)Now please check the subscriber terminal to see the received data which is shown below