MOSQUITTO.CONF(5) (NAME) mosquitto.conf - mosquitto (SYNOPSIS) mosquitto.conf (DESCRIPTION) mosquitto.conf mosquitto . mosquitto . mosquitto . mosquitto(8) . mosquitto SIGHUP Signals mosquitto(8) . . (SECTIONS) : (File Format) . (Authentication) . (General Options) Mosquitto. (Listeners) MQTT Mosquitto SSL/TLS (PSK). (Configuring Bridges) (broker) SSL/TLS . (Other) . (FILE FORMAT) # () . . (space) . (AUTHENTICATION) (listener) . . : https://mosquitto.org/documentation/authentication-methods/ . . SSL/TLS certfile keyfile . MQTT / . password_file . . per_listener_settings . Mosquitto Dynamic Security / . : https://mosquitto.org/documentation/dynamic-security/ . require_certificate true false . false SSL/TLS : / MQTT . require_certificate true . use_identity_as_username use_subject_as_username . true use_identity_as_username (Common Name CN) MQTT . . CA cafile capath . use_identity_as_username false ( password_file) MQTT . use_subject_as_username (subject) CN. psk_hint psk_file MQTT . use_identity_as_username true PSK MQTT . use_identity_as_username false password_file / MQTT . PSK . password_file acl_file psk_file SQL . . . (GENERAL OPTIONS) acl_file : mosquitto_acl_file . per_listener_settings . (ACL) . (topics) . . : topic [read|write|readwrite|deny] "read" "write" "readwrite" "deny" . ( ) - read/write . + # . "deny" read/write/readwrite . "deny" / . allow_anonymous true . : user password_file (clientid). ACL . topic pattern . pattern [read|write|readwrite|deny] : o %c (client id) o %u . ACL "user" . : pattern write sensor/%u/data : pattern write $SYS/broker/connection/%c/state ACL # . per_listener_settings true . per_listener_settings false . : $SYS . $SYS/broker/connection/+/state . . ACL . . : https://mosquitto.org/documentation/dynamic-security/ allow_anonymous [ true | false ] . false . false true . listener_allow_anonymous . (: ) per_listener_settings true . per_listener_settings false . 1.6.x true . . allow_duplicate_messages [ true | false ] . true . foo/# foo/+/baz MQTT foo/bar/baz . Mosquitto . . true QoS=2 . true . . . allow_zero_length_clientid [ true | false ] MQTT 3.1.1 MQTT 5 . / . true . auto_id_prefix . per_listener_settings true . per_listener_settings false . . auth_plugin_deny_special_chars [ true | false ] true ACL / '+' '#' . ACL . ACL . mosquitto CVE-2017-7650 . ( ) false ACL . true . . . auto_id_prefix listener_auto_id_prefix . allow_zero_length_clientid true . auto- . per_listener_settings true . per_listener_settings false . . autosave_interval mosquitto . 0 mosquitto SIGUSR1 . (persistence) . 1800 (30 ) . . . autosave_on_changes [ true | false ] true mosquitto (retained) autosave_interval . false mosquitto autosave_interval . . . . check_retain_source [ true | false ] . . check_retain_source true () . false . per_listener_settings . clientid_prefixes . clientid_prefixes . "secure-" "secure-client" "mqtt" . . . . . connection_messages [ true | false ] true . false . . . enable_control_api [ true | false ] true $CONTROL/broker/v1 . . $CONTROL/broker/# . . . global_max_clients . clean_session = False ( MQTT v3.x) ( MQTT v5). max_connections . global_max_clients 1000 max_connections 10 10 1000 . . -1 () . . global_max_connections . global_max_clients max_connections . . -1 () . . global_plugin . per_listener_settings . plugin . per_listener_settings true global_plugin plugin ( ) . per_listener_settings false global_plugin plugin . include_dir include_dir . . '.conf' . . . . include_dir . : include_dir. b.conf A.conf 01.conf a.conf B.conf 00.conf include_dir : 00.conf 01.conf A.conf a.conf B.conf b.conf include_dir . : include_dir. one.d B.conf C.conf two.d A.conf D.conf : include_dir one.d include_dir two.d : # one.d B.conf C.conf # two.d A.conf D.conf log_dest . : stdout stderr syslog topic file dlt android. stdout stderr . syslog syslog /var/log/messages . topic '$SYS/broker/log/' severity E W N I M (error) (warning) (notice) (information) (message) . log_type subscribe unsubscribe $SYS/broker/log/M/subscribe $SYS/broker/log/M/unsubscribe . (debug) . file "log_dest file /var/log/mosquitto.log". HUP . . dlt `Diagnostic Log and Trace` . Mosquitto DLT . android logd . "log_dest none" . stderr . . "log_dest none" stdout stderr . . log_facility syslog ( ) "daemon" . log_facility local0 local7 . "log_facility 5" local5. log_timestamp [ true | false ] true . true . . log_timestamp_format . (Unix epoch) . strftime . ISO 8601: log_timestamp_format %Y-%m-%dT%H:%M:%S . log_type . : debug error warning notice information subscribe unsubscribe websockets none all. error warning notice information . . debug ( / ) . . max_inflight_bytes QoS 1 2 (in flight) . . 100 100 . 0 ( ). max_inflight_messages . . . max_inflight_messages QoS 1 2 . (handshake) . 20 . 0 . 1 . . . max_keepalive MQTT v5 "server keepalive" . keepalive . max_keepalive keepalive server keepalive max_keepalive . MQTT v5 . 65535 . keepalive 0 . 0 . 0 keepalive = 0 keepalive . . MQTT v3.1.1 v3.1 keepalive . MQTT v3.1.1 v3.1 max_keepalive CONNACK "identifier rejected" . . . max_packet_size MQTT v5 "maximum packet size" MQTT value . MQTT (payload). . . v3.1.1 . 2.1 2000000 . . MQTT v5 MQTT v3.1.1 MQTT v3.1 . 20 . . . max_queued_bytes QoS 1 2 ( ) . (silently dropped). / . 0 ( ). max_queued_messages . max_queued_messages max_queued_bytes . . . max_queued_messages QoS 1 2 ( ) . 1000 . 0 ( ). queue_qos0_messages max_queued_bytes . . . memory_limit (heap) . . . . . . . . . message_size_limit (publish payload) . . QoS QoS 1 QoS 2 . MQTT v5 QoS 1 QoS 2 PUBACK PUBREC "implementation specific error" . 0 MQTT . MQTT 268435455 . . . password_file : mosquitto_password_file . per_listener_settings . . . mosquitto_passwd(1) . mosquitto TLS ( TLS ) "username:password" . allow_anonymous false . allow_anonymous true password_file acl_file / . per_listener_settings true . per_listener_settings false . . . . : mosquitto_passwd(1) https://mosquitto.org/documentation/dynamic-security/ per_listener_settings [ true | false ] true . : password_file acl_file psk_file allow_anonymous allow_zero_length_clientid auto_id_prefix. plugin plugin_opt_* true ( clean session false) ACL . false mosquitto . . persistence [ true | false ] true (persistence) . . mosquitto.db persistence_location . mosquitto mosquitto.db . mosquitto autosave_interval . SIGUSR1 mosquitto . false . false . . . . . . persistence_file . mosquitto.db . . . persistence_location . . . . persistent_client_expiration ( clean session false ) . MQTT v3.1 . MQTT v3.1.1 v5.0 . clean session false . . . s h d w m y . : o persistent_client_expiration 2m o persistent_client_expiration 14d o persistent_client_expiration 1y . . . . . pid_file pid . () pid . pid mosquitto . mosquitto init pid . /var/run/mosquitto/mosquitto.pid . . plugin_opt_* plugin . . /global_plugin . auth_opt_* . plugin . / . . . password_file acl_file plugin . . per_listener_settings true . : https://mosquitto.org/documentation/dynamic-security/ global_plugin. auth_plugin . psk_file (PSK) . PSK . . "identity:key" "0x" . PSK PSK . per_listener_settings true . per_listener_settings false . . . . queue_qos0_messages [ true | false ] true QoS 0 . QoS 1 2 QoS 0 . max_queued_messages . false . MQTT v3.1.1 QoS 1 2 . . . retain_available [ true | false ] false (retained) . false retain . true . . . retain_expiry_interval mosquitto message-expiry-interval - . message-expiry-interval . . (off) . . . . set_tcp_nodelay [ true | false ] true TCP_NODELAY Nagle . TCP . false . . . sys_interval $SYS . 10 . $SYS 0 . . . upgrade_outgoing_qos [ true | false ] MQTT QoS QoS . . upgrade_outgoing_qos true QoS . . false . . . user (root) . "mosquitto" "mosquitto" mosquitto "nobody" . mosquitto . / . . mosquitto . mosquitto . . (LISTENERS) mosquitto (listeners) . . (General Options) accept_protocol_versions . MQTT . 3 4 5 : # v5.0 : listener 1883 accept_protocol_versions 5 # v3.1 v3.1.1 : listener 1884 accept_protocol_versions 3, 4 . . bind_address . listener . IP/ . . mosquitto "bind_address localhost" . . listener . listener . . bind_interface . bind_address . bind_address bind address/host listener bind_interface . AIX . . enable_proxy_protocol [ 2 | 1 ] PROXY . 1 2 2 TLS . / HAProxy Mosquitto PROXY . PROXY . IP . Mosquitto Mosquitto . . PROXY 2 TLS (TLS termination) . TLS . proxy_protocol_v2_require_tls TLS - . require_certificate TLS . use_identity_as_username commonName CONNECT . TLS . use_subject_as_username certfile keyfile enable_proxy_protocol . . http_dir http_api http . http_dir . http . Mosquitto libwebsockets . 3.0 . . listener [ bind// ] . IP/ . bind_address port . bind address/host IP IP . IP . Unix Domain Sockets TCP . 0 . . mount_point . . listener_allow_anonymous [ true | false ] . allow_anonymous . false . allow_anonymous . . auto_id_prefix ( ) . auto- . . max_connections . "" -1 . mosquitto . limits.conf() . . max_qos QoS . 2 QoS . QoS 0 1 . MQTT v5 . MQTT v3.1.1 . QoS . . max_topic_alias_broker MQTT v5 Mosquitto (topic aliases) . . . . . Mosquitto MQTT v5 . topic-alias-maximum 100 10 10 . topic-alias-maximum 20 100 20 . 10 . 65535. 0 . . max_topic_alias MQTT v5 . . 10 . 0 . 65535 . . mount_point listener . . . (mount point) example example . . port . listener . . 1883 . . listener . protocol . mqtt () websockets http_api . mqtt: MQTT. websockets: MQTT . libwebsockets TLS cafile certfile keyfile ciphers ciphers_tls1.3. http_api: ( http_dir ) HTTP API . TLS certfile keyfile . - loopback . . proxy_protocol_v2_require_tls [ true | false ] PROXY TLS . true PROXY TLS . . false . . socket_domain [ ipv4 | ipv6 ] IP . IPv4 IPv6 . IPv6 IPv6 IPv6 . IPv4 ipv4 IPv6 ipv6 . IPv4 IPv6 socket_domain . . use_username_as_clientid [ true | false ] use_username_as_clientid true . . false . true . clientid_prefixes . . : use_identity_as_username. . packet_buffer_size , websockets_headers_size MQTT . 4096 . read() . . . websockets_log_level . . libwebsockets lws_log_levels . libwebsockets . log_type websockets . 0 . websockets_origin WebSockets http . . http://example.com:8080. . . libwebsockets 3.1.0 . SSL/TLS (Certificate based SSL/TLS Support) SSL . << SSL/TLS >> . cafile cafile CA PEM . capath capath CA PEM . capath ".pem" "openssl rehash < capath>" . capath . certfile PEM. keyfile TLS . Mosquitto SIGHUP . . ciphers _ (ciphers) TLS v1.2 . "openssl ciphers" . ciphers_tls1.3 _ TLS v1.3 . crlfile require_certificate true (CRL) . crlfile PEM . dhparamfile - (ephemeral DH) (forward security) DH . dhparamfile . dhparamfile : openssl dhparam -out dhparam.pem 2048 disable_client_cert_date_checks [ true | false ] true disable_client_cert_date_checks require_certificate true . false . keyfile tls_keyform "pem" PEM . certfile TLS . tls_keyform "engine" (engine handle) . SIGHUP Mosquitto . . require_certificate [ true | false ] SSL/TLS https CA . . require_certificate true . MQTT . tls_engine openssl . openssl engine . tls_engine_kpass_sha1 _sha1__ SHA1 TLS. TLS TPM . SHA1 . tls_keyform [ pem | engine ] TLS . "pem" "engine" . TPM . "pem" . tls_version TLS . tlsv1.3 tlsv1.2. TLS v1.3 v1.2 . 1.6.x Mosquitto TLS . use_identity_as_username [ true | false ] require_certificate true use_identity_as_username true CN . true password_file . true use_subject_as_username . use_subject_as_username . use_subject_as_username [ true | false ] require_certificate true use_subject_as_username true (subject) . true password_file . : CN=test client,OU=Production,O=Server,L=Nottingham,ST=Nottinghamshire,C=GB. use_identity_as_username . SSL/TLS (Pre-shared-key based SSL/TLS Support) SSL . << SSL/TLS >> . ciphers _ PSK PSK . . "openssl ciphers" . psk_hint (hint) psk_hint . . . psk_file . tls_version TLS . tlsv1.3 tlsv1.2. TLS v1.3 v1.2 . 1.6.x Mosquitto TLS . use_identity_as_username [ true | false ] use_identity_as_username psk . password_file . . (CONFIGURING BRIDGES) ( ) . . address [:] [[:]], addresses [:] [[:]] . . 1883 . IPv6 . address . round_robin . bridge_attempt_unsubscribe [ true | false ] "out" (unsubscribe) . "in" "out" . bridge_attempt_unsubscribe false . true . bridge_bind_address bridge_bind_address IP bridge_bind_address 192.168.1.10. bridge_max_packet_size . . MQTT v5 maximum-packet-size . . "" 0 . bridge_max_topic_alias MQTT v5 . 10 65535. 0 . bridge_outgoing_retain [ true | false ] MQTT (retained) . MQTT v5 MQTT v3.1.1 v3.1 . v3.1.1 v3.1 bridge_outgoing_retain false . retain . true . bridge_protocol_version MQTT . mqttv50 mqttv311 mqttv31 . mqttv311 . bridge_receive_maximum MQTT v5.0 bridge_receive_maximum QoS 1 2 . 1 65535 . max_inflight_messages 20 . bridge_session_expiry_interval MQTT v5.0 bridge_session_expiry_interval . 0 . 0xFFFFFFFF . . 0 . bridge_tcp_keepalive TCP keepalive . MQTT . PINGREQ . . bridge_tcp_user_timeout ( ) TCP . " 20 " ( tcp ). tcp_retries2 . . TCP Keepalive . : https://blog.cloudflare.com/when-tcp-sockets-refuse-to-die/ . cleansession [ true | false ] clean session . false () . true . true . cleansession false () . . cleansession true cleansession false . local_cleansession [ true | false] cleansession . local_cleansession . false . bridge.cleansession . connection . . keepalive_interval . 60 . 5 . idle_timeout lazy . 60 . local_clientid . local. . local_clientid remote_clientid . local_password . ACL . local_username . ACL . notifications [ true | false ] true . $SYS/broker/connection//state notification_topic . 1 0 . true . (Last Will and Testament LWT) . notifications_local_only [ true | false ] true . false . notification_topic . $SYS/broker/connection//state . remote_clientid . 'name.hostname' name hostname . "clientid" / . "clientid" . remote_password . MQTT v3.1 / . remote_username . "password" / . "password" . remote_username . MQTT v3.1 / . remote_password . "username" / . "username" . restart_timeout [], restart_timeout (automatic) . "Decorrelated Jitter" (base) (cap) . base . stable stable . 1 3600 . 7200 . 20 : restart_timeout 20 ( ) 10 ( ) 60 : restart_timeout 10 60 30 : restart_timeout 10 60 30 5 30 . round_robin [ true | false ] address/addresses round_robin . round_robin false ( ) . . . round_robin true . . start_type [ automatic | lazy | once ] . : automatic lazy once. RSMB "manual" mosquitto . automatic (30 ) . lazy threshold . idle_timeout . . once . threshold lazy . 10 . topic [[[ out | in | both ] -qos] - -] . ( ) . . in out . out . QoS QoS / 0 . local-prefix remote-prefix (remap) . . . . . . "" . . . (Full Local Topic) (Full Remote Topic) . L/topic R/topic . +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ | | | | | | | |(Pattern) | | | (Validity) | | | | | (Local Prefix) | (Remote | | | | | | | Prefix) | | (Full Local | (Full | | | | | | Topic) | Remote Topic) | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |pattern | L/ | R/ | | L/pattern | R/pattern | | | | | (valid) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |pattern | L/ | "" | | L/pattern | pattern | | | | | (valid) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |pattern | "" | R/ | | pattern | R/pattern | | | | | (valid) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |pattern | "" | "" | | pattern | pattern | | | | | ( | | | | | | | | | | | | | | ) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |"" | local | remote | | local | remote | | | | | ( | | | | | | | | | | | | | | | | | | | | | | | | | | | | ) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |"" | local | "" | | | | | | | | (invalid) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |"" | "" | remote | | | | | | | | (invalid) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ |"" | "" | "" | | | | | | | | (invalid) | | | +-------------+--------------------+--------------------+-----------------------+-----------------+-----------------+ : topic # both 2 local/topic/ remote/topic/ . . . cleansession . : . test.mosquitto.org . $SYS/broker/clients/total test/mosquitto/org/clients/total . connection test-mosquitto-org address test.mosquitto.org cleansession true topic clients/total in 0 test/mosquitto/org/ $SYS/broker/ try_private [ true | false ] try_private true . . try_private false . true . bridge_reload_type [ lazy | immediate ] . bridge_reload_type lazy immediate . lazy . immediate . SSL/TLS (SSL/TLS Support) SSL/TLS . bridge_alpn alpn (ALPN) TLS . WebSockets MQTT . bridge_cafile bridge_cafile bridge_capath bridge_tls_use_os_certs SSL/TLS . bridge_cafile CA PEM . bridge_capath bridge_cafile bridge_capath bridge_tls_use_os_certs SSL/TLS . bridge_capath CA PEM . bridge_capath ".crt" "openssl rehash < bridge_capath>" . bridge_certfile PEM . bridge_identity . bridge_identity bridge_psk PSK . PSK . PSK . bridge_insecure [ true | false ] TLS / . bridge_insecure true . true false . bridge_keyfile PEM . bridge_psk . bridge_identity bridge_psk PSK . "0x" . PSK . bridge_require_ocsp [ true | false ] true OCSP TLS . bridge_tls_use_os_certs [ true | false ] bridge_cafile bridge_capath bridge_tls_use_os_certs SSL/TLS . bridge_tls_use_os_certs true TLS openssl . . false . bridge_tls_version TLS . tlsv1.3 tlsv1.2. tlsv1.2 . TLS . bridge_ciphers _ TLS v1.2 . "openssl ciphers" . bridge_ciphers_tls1.3 _ TLS v1.3 . (FILES) mosquitto.conf (BUGS) mosquitto : https://github.com/eclipse-mosquitto/mosquitto/issues (SEE ALSO) mosquitto(7), mosquitto(8), mosquitto_passwd(1), mosquitto-tls(7), mqtt(7), limits.conf(5) (AUTHORS) Roger Light Mosquitto Project 04/03/2026 MOSQUITTO.CONF(5)