I have generated client key certificate on self signed secure Mosquitto server. I have copied CA and client certificate with client key into client machine. Client subscription runs fine:

mosquitto_sub -h -t sensor --cafile ca.crt --cert client.crt --key client.key -p 8883 -d

But what if somebody hack my client machine and will get credentials. How I can disable this certificate in server machine?


Generally, if your client certificate's private key is compromised, the CA should revoke your certificate and inform the relying parties via CRLs or OCSP.

Mosquitto only understands CRLs, using the crlfileoption.

You must download this manually to a local PEM file and point Mosquitto to this file with the above option.

| improve this answer | |
  • How does this crlfile should look like? Should I copy all failed certificates into it? – vico Dec 31 '19 at 18:44
  • A CRL (as pointed to by crlfile) is a file generated by your CA. The CRL format is defined in RFC5280 - you cannot simply copy certificates into a list. Speak to your CA admins. – garethTheRed Dec 31 '19 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.