MQTT is a machine-to-machine (M2M)/”Internet of Things” connectivity protocol.

Eclipse Mosquitto is an open source message broker that implements the MQTT protocol.

MQTT Mosquitto broker with SSL/TLS transport security

Mosquitto configuration:
To configure the Mosquito broker we need first to copy the certificates and key files to a known directory. We will create a certs directory under /etc/mosquitto.

After this we can modify the mosquitto configuration file. One important thing to keep in mind is that lines must be following each other without blank lines after the listener directive.

Authentication by using client certificates
Using client certificates, signed by a certificate authority, assures the client identity. The certificate authority used must be the same used by the server certificates and is only supported over TLS/SSL.
For using client certificates for authentication, we need to change the listener configuration for TLS/SSL by adding the following directives:

The require_certificate directive with the value true means that clients must now provide a client certificate to connect.
The use_identity_as_username means that the user name of the connecting user is taken from the CN (Common Name) property of the certificate, otherwise we still need to provide an user and password.

And we should have three files, two of them the user1.crt, the user certificate, and the user1.key, the user1 private key.

Source: