MQTT Broker with Mosquitto and TLS: Installation and Setup on Linux and Windows

What is MQTT?

MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol based on the publish-subscribe model, designed for networks with limited bandwidth and intermittent connections — typical conditions for a 4G gateway in the field. A device publishes messages to a topic (e.g. device/001/energy); other devices subscribed to that topic receive them automatically. The broker acts as an intermediary: it receives, filters and distributes messages without publisher and subscriber needing to connect directly. MQTT operates over TCP/IP (port 1883 unencrypted, 8883 with TLS) and is ISO/IEC 20922 standard.

Mosquitto is the reference open-source MQTT broker maintained by the Eclipse Foundation. It supports MQTT 3.1, 3.1.1 and 5.0, weighs less than 1 MB and installs in under 5 minutes. This guide covers installation on Windows and Linux, TLS certificate generation with OpenSSL and user/password authentication configuration — the same steps you need to securely receive data from an IoT gateway.

When to use Mosquitto

• Self-hosted installations where you have full server control (VPS, local server, Raspberry Pi).
• Development and testing environments before migrating to a cloud broker (AWS IoT Core, HiveMQ Cloud).
• Deployments with strict privacy requirements where data cannot leave your network.
• Low-budget projects — Mosquitto is completely free with no connection limits.

TLS certificate architecture

For MQTT over TLS (port 8883) you need three files: a CA certificate you self-sign, a server certificate signed by that CA, and — optionally — client certificates for mutual authentication (mTLS). IoT gateways support all three modes.

Requirements

• Server with a public IP or domain name accessible from the Index AMI (if external).
• TCP port 8883 open in the server firewall.
• OpenSSL installed (included with Mosquitto on Windows; available as a package on Linux).

Step 1 — Install Mosquitto

Linux (Ubuntu / Debian)

On Ubuntu 22.04 / Debian 12:

sudo apt update && sudo apt install -y mosquitto mosquitto-clients
sudo systemctl enable --now mosquitto

Verify the service is active:

systemctl status mosquitto
# ● mosquitto.service - Mosquitto MQTT Broker
#    Active: active (running)

Windows 10 / 11

Download the official installer from mosquitto.org/download (choose the Win64 .exe version). Run as Administrator. The installer includes mosquitto.exe, mosquitto_passwd.exe and OpenSSL.

# Alternative via winget
winget install EclipseFoundation.Mosquitto

Verify the service is installed:

sc query mosquitto
# STATE : 4  RUNNING

The installer registers Mosquitto as a Windows service (name: mosquitto). Manage it from services.msc or PowerShell.

Step 2 — Generate TLS certificates with OpenSSL

Certificates are the same on Linux and Windows — the OpenSSL process is identical. Generate three files: CA, server and, optionally, client.

Generate the certificates once and reuse them for all gateways connecting to the same broker.

Linux (Ubuntu / Debian)

From terminal (Linux) — create a working directory:

mkdir ~/mosquitto-certs && cd ~/mosquitto-certs

# 1. Create the CA (self-signed certificate authority)
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
  -subj "/CN=MyCA-MQTT/O=MyOrganization/C=US"

# 2. Create the server certificate
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr \
  -subj "/CN=broker.mydomain.com/O=MyOrganization/C=US"
openssl x509 -req -days 3650 -in server.csr \
  -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

# 3. (Optional) Create client certificate (for mTLS)
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr \
  -subj "/CN=Index AMI-001/O=MyOrganization/C=US"
openssl x509 -req -days 3650 -in client.csr \
  -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt

Windows 10 / 11

From PowerShell or CMD as Administrator (OpenSSL included with Mosquitto at C:\Program Files\mosquitto\):

cd "C:\Program Files\mosquitto"
mkdir certs && cd certs

# 1. Create the CA
.\openssl.exe genrsa -out ca.key 4096
.\openssl.exe req -new -x509 -days 3650 -key ca.key -out ca.crt `
  -subj "/CN=MyCA-MQTT/O=MyOrganization/C=US"

# 2. Create the server certificate
.\openssl.exe genrsa -out server.key 2048
.\openssl.exe req -new -key server.key -out server.csr `
  -subj "/CN=broker.mydomain.com/O=MyOrganization/C=US"
.\openssl.exe x509 -req -days 3650 -in server.csr `
  -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt

The CN of the server certificate must match the hostname or IP that clients will use to connect. If using a direct IP, put the IP in the CN. If you have a domain, put the FQDN.

Step 3 — Configure mosquitto.conf

Linux (Ubuntu / Debian)

Edit or create the main configuration file: /etc/mosquitto/conf.d/tls.conf

# Standard MQTT over TLS port
listener 8883

# TLS certificates
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

# Require client certificate (mTLS) — set false for TLS without mTLS
require_certificate false

# Disable unencrypted listener (recommended in production)
# listener 1883
# allow_anonymous false

# User/password authentication (see Step 5)
# password_file /etc/mosquitto/passwd

Windows 10 / 11

On Windows, the configuration file is at: C:\Program Files\mosquitto\mosquitto.conf

Open port 8883 in the firewall:

sudo ufw allow 8883/tcp
sudo ufw reload

New-NetFirewallRule -DisplayName "Mosquitto MQTT TLS" `
  -Direction Inbound -Protocol TCP `
  -LocalPort 8883 -Action Allow

Step 4 — Verify the broker with mosquitto_sub and mosquitto_pub

From another terminal (or from the same server as a test), subscribe to a test topic:

Linux (Ubuntu / Debian)

# Terminal 1 — subscribe
mosquitto_sub -h broker.mydomain.com -p 8883 \
  --cafile ~/mosquitto-certs/ca.crt \
  -t "test/message" -v

# Terminal 2 — publish
mosquitto_pub -h broker.mydomain.com -p 8883 \
  --cafile ~/mosquitto-certs/ca.crt \
  -t "test/message" -m "Hello TLS broker"

Windows 10 / 11

On Windows, mosquitto_sub.exe and mosquitto_pub.exe are in C:\Program Files\mosquitto\:

cd "C:\Program Files\mosquitto"
.\mosquitto_sub.exe -h broker.mydomain.com -p 8883 `
  --cafile "C:\Program Files\mosquitto\certs\ca.crt" `
  -t "test/message" -v

.\mosquitto_pub.exe -h broker.mydomain.com -p 8883 `
  --cafile "C:\Program Files\mosquitto\certs\ca.crt" `
  -t "test/message" -m "Hello TLS broker"

Terminal 1 should show: test/message Hello TLS broker — this confirms the TLS broker is operational.

Step 5 — User/password authentication (recommended)

Create a password file to prevent anonymous connections. Each Index AMI should have its own credentials.

Linux (Ubuntu / Debian)

# Create the password file and add a user
sudo mosquitto_passwd -c /etc/mosquitto/passwd gateway_user
# You will be prompted for the password — use a strong unique one per device

# Restart the broker to apply
sudo systemctl restart mosquitto

Windows 10 / 11

# In PowerShell as Administrator
cd "C:\Program Files\mosquitto"
.\mosquitto_passwd.exe -c "C:\Program Files\mosquitto\passwd" gateway_user
# Restart the service
Restart-Service -Name "mosquitto"

Add these lines to mosquitto.conf to enable authentication:

allow_anonymous false
password_file /etc/mosquitto/passwd    # Linux
# password_file C:\Program Files\mosquitto\passwd    # Windows

Connect the Index AMI to the broker

Once the broker is active with TLS, configure the following parameters on the Index AMI (MQTT configuration guide):

• MQTT Host: public IP or FQDN of the server running Mosquitto.
• Port: 8883 (MQTT over TLS).
• Transport: MQTT over SSL.
• CA certificate: the ca.crt file generated in Step 2.
• Client certificate and private key: client.crt and client.key if using mTLS.
• Username and password: the credentials created in Step 5.
• Client ID: a unique identifier per Index AMI (e.g. gw-MET-NORTH-001).

Troubleshooting

Next steps

With the broker active, configure the Index AMI using the MQTT guide. To interpret the LTE signal metrics shown in the Index AMI Overview, see the LTE signal article.