# listener 1883
# allow_anonymous true

listener 8883
protocol mqtt

cafile /mosquitto/certs/ca.pem
certfile /mosquitto/certs/server.pem
keyfile /mosquitto/certs/server.key

require_certificate true             # enforce client cert
use_identity_as_username true        # CN becomes MQTT username
allow_anonymous true                # optional: false for strict auth