I found it to be much easier to put haproxy in TCP mode in front of mosquitto than to use mosquitto's TLS capabilities. This lets me reload the certificate without restarting mosquitto.
My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.
My local devices (esp8266) can't really handle TLS well, but I want access from outside of my local network to be encrypted. This lets them operate in plain-text mode locally, with firewall rules forcing outside access to be secure.