Configuring MQTT broker(Mosquitto) to use SSL Encryption isn't working - ssl

Question

I am trying to configure my MQTT broker(mosquito) to connect with MQTT client over SSL. For that I created ca.crt , server.crt, and server.key.
Then I edited the mosquito config file like this:
listener 8883
certfile /etc/mosquitto/ca_certificates/server.crt
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/ca_certificates/server.key
require_certificate false
use_identity_as_username true
When creating these certificates, I have made sure to add the common name to 127.0.0.1 as suggested in this guide
After that I run my mosquito broker using the config file that I created using:
mosquitto -c /etc/mosquitto/conf.d/password.conf
This command starts my MQTT broker and it starts listening at port 8883.
1645181786: mosquitto version 2.0.11 starting
1645181786: Config loaded from /etc/mosquitto/conf.d/password.conf.
1645181786: Opening ipv4 listen socket on port 8883.
1645181786: Opening ipv6 listen socket on port 8883.
1645181786: mosquitto version 2.0.11 running
Uptil here, I believe that now my broker will only allow connection at port 8883 only when ca.crt is provided in the connection call.
So, then I use this pub command to send a message to a test topic.
mosquitto_pub -h 127.0.0.1 -p 8883 --cafile /etc/mosquitto/ca_certificates/ca.crt -t test -m 45
But it results in following error:
1645182944: New connection from 127.0.0.1:58926 on port 8883.
1645182944: Client auto-7B1E49DA-54C1-532B-3948-35FFD3A11250 disconnected, not authorised.
Then I added a password file and added path to that password file in my mosquitto config file. My new config file started looking like this:
listener 8883
password_file /etc/mosquitto/conf.d/passwords
certfile /etc/mosquitto/ca_certificates/server.crt
cafile /etc/mosquitto/ca_certificates/ca.crt
keyfile /etc/mosquitto/ca_certificates/server.key
require_certificate false
use_identity_as_username true
After this update when I run the mosquitto_pub command with both my certificates and username, password. The client successfully connects to broker.
mosquitto_pub -h 127.0.0.1 -p 8883 --cafile /etc/mosquitto/ca_certificates/ca.crt -t test -m 45 -u "user" -P "pass123"
Note: if I run the pub command using only certs or only with password, it doesn't connect and it shouldn't too. Giving both attributes work only.
But what I want is to connect using only SSL certificates. Any help would be much appreciated.

Answer 1

The problem is probably use_identity_as_username true which tells mosquitto to use the client certificate's CN as the username.
But you are not sending a client certificate (the --cafile option is passing a CA cert to verify the brokers cert) in any of the examples you are showing, so remove that line from the config and see if it works.
EDIT:
If you also don't want to need to supply a username/password (or use a client certificate to identify a user) you need to include the allow_anonymous true configuration option.