Version 1.1.3 released

This is a minor bugfix release that addresses some problems identified during Debian packaging.


  • mosquitto_passwd utility now uses tmpfile() to generate its temporary data storage file. It also creates a backup file that can be used to recover data if an errors occur.
  • Build script fixes to help packaging on Debian.

MQTT standardisation - OASIS call for participation

The MQTT protocol is going for standardisation at OASIS. A technical committee is being formed and there is a call for participation for interested parties. There are details at the link below:"

The plan seems to be to take the 3.1 spec as it is for standardisation and see about changes in the future. If you are interested in taking part see the link above, but note that you need to be a paid up member of OASIS.

Version 1.1.2 released

This is a bugfix release.

Client library

  • Fix tls_cert_reqs not being set to SSL_VERIFY_PEER by default. This meant that clients were not verifying the server certificate when connecting over TLS. This affects the C, C++ and Python libraries.

Source and binaries are available on the download page.

Version 1.1.1 released

This is a bugfix release.


  • Fix crash on reload if using acl patterns.

Client library

  • Fix static C++ functions not being exported on Windows. Fixes bug #1098256.

Binaries should be available shortly.

Mosquitto Debian repository

On a previous post I described how to make mosquitto debian packages. This turned out to be a bit problematic, so I've now put up an experimental debian repository for mosquitto. It includes packages for the i386, amd64, armel and raspberry pi (raspbian armhf ) architectures.

It's worth repeating that this is experimental - there are package changes that haven't been vetted by a Debian developer so it's possible something will break. I've tested myself and had no problems so far.

To use the new repository you should first import the repository package signing key:

sudo apt-key add mosquitto-repo.gpg.key

Then make the repository available to apt:

cd /etc/apt/sources.list.d/

Then one of the following, depending on which version of debian you are using:

sudo wget
sudo wget
sudo wget

Then update apt information:

apt-get update

And discover what mosquitto packages are available:

apt-cache search mosquitto

Or just install:

apt-get install mosquitto

Version 1.1 released

This is a feature and bugfix release.


  • Add $SYS/broker/messages/dropped
  • Add $SYS/broker/clients/expired
  • Replace $SYS/broker/+/per second/+ with moving average versions published at $SYS/broker/load/#
  • Add $SYS/broker/load/sockets/+ and $SYS/broker/load/connections/+
  • Documentation on password file format has been fixed.
  • Disable SSL compression. This reduces memory usage significantly and removes the possibility of CRIME type attacks.
  • Enable SSL_MODE_RELEASE_BUFFERS mode to reduce SSL memory usage further.
  • Add allow_duplicate_messages option.
  • ACL files can now have comment lines with # as the first character.
  • Display message on startup about which config is being loaded.
  • Fix max_inflight_messages and max_queued_messages not being applied.
  • Fix documentation error in mosquitto.conf.
  • Ensure that QoS 2 queued messages are sent out in a timely manner.
  • Local bridges now act on clean_session correctly.
  • Local bridges with clean_session==false now remove unused subscriptions on broker restart.
  • The $SYS/broker/heap/# messages now no longer include "bytes" as part of the string for ease of use.

Client library

  • Free memory used by OpenSSL in mosquitto_lib_cleanup() where possible.
  • Change WebSocket subprotocol name to mqttv3.1 to make future changes easier and for compatibility with other implementations.
  • mosquitto_loop_read() and mosquitto_loop_write() now handle errors themselves rather than having mosquitto_loop() handle their errors. This makes using them in a separate event loop more straightforward.
  • Add mosquitto_loop_forever() / loop_forever() function call to make simple clients easier.
  • Disable SSL compression. This reduces memory usage significantly and removes the possibility of CRIME type attacks.
  • Enable SSL_MODE_RELEASE_BUFFERS mode to reduce SSL memory usage further.
  • mosquitto_tls_set() will now return an error or raise an exception immediately if the CA certificate or client certificate/key cannot be accessed.
  • Fix potential memory leaks on connection failures.
  • Don't produce return error from mosquitto_loop() if a system call is interrupted. This prevents disconnects/reconnects in threaded mode and simplifies non-threaded client handling.
  • Ignore SIGPIPE to prevent unnecessary client quits in threaded mode.
  • Fix document error for mosquitto_message_retry_set().
  • Fix mosquitto_topic_matches_sub() for subscriptions with + as the final character. Fixes bug #1085797.
  • Rename all "obj" parameters to "userdata" for consistency with other libraries.
  • Reset errno before network read/write to ensure EAGAIN isn't mistakenly returned.
  • The message queue length is now tracked and used to determine the maximum number of packets to process at once. This removes the need for the max_packets parameter which is now unused.
  • Fix incorrect error value in Python error_string() function. Fixes bug #1086777.
  • Reset last message in/out timer in Python module when we send a PINGREQ. Fixes too-early disconnects.


  • Clients now display their own version number and library version number in their help messages.
  • Fix mosquitto_pub -l -q 2 disconnecting before all messages were transmitted.
  • Fix potential out-of-bounds array access with client ids. Fixes bug #1083182.


  • mosquitto_passwd can now convert password files with plain text files to hashed versions.

Making Mosquitto packages for Debian yourself

As Debian has been in feature freeze since before Mosquitto 1.0 was released, it will be a long time until there is an updated version of Mosquitto in Debian. It is, however, fairly straightforward to do the packaging yourself. Here's how to do that from the command line.

Download and unpack the mosquitto source tarball:

tar -zxf mosquitto-1.1.2.tar.gz

Rename the tarball to match Debian requirements:

mv mosquitto-1.1.2.tar.gz mosquitto_1.1.2.orig.tar.gz

The current mosquitto packaging files are available at - you want the .debian.tar.xz.

The next step is to build the package, but you may find that you need to install some packages first:

sudo apt-get install build-essential python quilt libwrap0-dev libssl-dev devscripts python-setuptools

To build the packages do

cd mosquitto-1.1.2/

You should now have a list of .deb files in the parent directory which you can install with:

sudo dpkg -i <deb file>

Please leave comments if you find this useful or have any problems.

Version 1.0.5 released

This is a bugfix release.


  • Fix crash when the broker has use_identity_as_username set to true but a client connects without a certificate.
  • mosquitto_passwd should only be installed if WITH_TLS=yes.


  • Use symbolic errno values rather than numbers in Python module to avoid cross platform issues (incorrect errno on Mac OS).


  • Build script fixes for FreeBSD.

Version 1.0.4 released

This is a bugfix release.


  • Deal with poll() POLLIN/POLLOUT before POLL[RD]HUP to correctly handle the case where a client sends data and immediately closes its socket.


  • Fix memory leak with messages of QoS=2. Fixes bug #1064981.
  • Fix potential thread synchronisation problem with outgoing packets in the Python module. Fixes bug #1064977.


  • Fix mosquitto_sub -l incorrectly only sending one message per second.