title: Mosquitto MQTT client certificate exception
body: <p>I'm developing an application that, in summary, uses MQTT to send sensor values to a broker to later visualize that data in a dashboard web application.
  I have five microcontrollers connected to the broker and I've set up a server certificate for the broker and client certificates for each microcontroller. </p>
  
  <p>The problem is that, in the mosquitto.conf file I require the use of client certificates for the clients that want to connect, so if I want to subscribe to a topic from my web application I need a client certificate. I'm trying to find the right approach for accomplishing this, but it seems that having a certificate and key in a machine you cannot control is a big security risk. </p>
  
  <p>It would be ideal if someone knew a way of tweaking the mosquitto configuration file or establish some kind of exception (maybe similar to ACL's) to only require client certificates for certain clients (in my case, the microcontrollers) and use username@password for the others (web clients). Is it possible to do such a thing?</p>
  
  <p>Any help would be much appreciated</p>
  
  <p><strong>EDIT</strong> (regarding @hardillb 's answer)</p>
  
  <p>My mosquitto.conf:</p>
  
  <pre><code>pid_file /var/run/mosquitto.pid
  
  persistence true
  persistence_location /var/lib/mosquitto/
  
  log_dest file /var/log/mosquitto/mosquitto.log
  
  include_dir /etc/mosquitto/conf.d
  
  per_listener_settings true
  
  listener 9873
  protocol websockets
  #http_dir /home/jamengual/Desktop/UIB/TFG/mqtt/webAPP
  cafile /etc/mosquitto/ca_certificates/ca.crt
  keyfile /etc/mosquitto/certs/server.key
  certfile /etc/mosquitto/certs/server.crt
  
  listener 8883
  cafile /etc/mosquitto/ca_certificates/ca.crt
  keyfile /etc/mosquitto/certs/server.key
  certfile /etc/mosquitto/certs/server.crt
  require_certificate true
  </code></pre>
  
  <p>The "per_listener_settings true" makes the server go to an active(exited) state.
  From the mosquitto.conf guide:</p>
  
  <p>Talking about authentication mechanisms: </p>
  
  <blockquote>
    <p>Both certificate and PSK based encryption are configured on a
    per-listener basis.</p>
  </blockquote>
  
  <p>Talking about the per_listener_settings options:</p>
  
  <pre><code>per_listener_settings [ true | false ]
  
      If true, then authentication and access control settings will be controlled on a per-listener basis. The following options are affected:
  
      password_file, acl_file, psk_file, allow_anonymous, allow_zero_length_clientid, auth_plugin, auth_opt_*, auto_id_prefix.
  </code></pre>
  
  <p>So I understand that the per_listener_settings option might not be necessary for the require_certificate part. However, I still need it to configure the usernames and passwords for the websockets.</p>
  
  <p>Is there something wrong with my configuration file?</p>
  
  <p><a href="https://security.stackexchange.com/questions/229094/client-certificate-and-key-storage-on-clients-machine">Link to my question about how to store client certificates and keys in the client's machine</a></p>