Run Mosquitto as the MQTT broker, point OwnTracks at a TLS listener (normally port 8883), and require authentication before exposing the service beyond your home network. OwnTracks publishes location messages; a recorder or any other subscriber is optional. The reliable order is: prepare an always-on host and DNS name, install Mosquitto, create credentials or client certificates, configure TLS, verify the broker locally, then connect the phone and test a location update.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Understand the pieces before you configure them
OwnTracks is the mobile publisher. Mosquitto is the broker that accepts the phone’s MQTT connection and routes messages to subscribers. The broker does not need a database or a recorder to function: you can subscribe with a command-line client, a home-automation system, or another application. Add OwnTracks Recorder only after the basic publish-and-subscribe path is working.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
The message path
- The phone resolves your broker’s DNS name and opens an MQTT connection.
- TLS authenticates the broker to the phone; password authentication or a client certificate authenticates the phone to Mosquitto.
- OwnTracks publishes a location payload to its configured topic namespace.
- Mosquitto forwards the message to every authorized subscriber, such as a test client or recorder.
This separation is useful when troubleshooting. A successful phone connection proves only that authentication and the MQTT session work; a subscriber test proves that messages are actually arriving on the expected topic.
Choose a deployment that can stay reachable
Use a machine or VPS that can remain online. For a phone connecting from outside your LAN, give the broker a stable DNS name such as mqtt.example.net. A changing residential address can be handled with dynamic DNS, but the name in the phone configuration must still resolve to the current public address.
#1 Best Overall
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
- LAN-only: a private address can work if every phone is on the same network or connected through your VPN.
- Publicly reachable: configure a DNS record, forward the chosen port from the router to the broker, and allow that port through the host firewall.
- Certificate validation: the hostname used by OwnTracks must appear in the server certificate’s Subject Alternative Name (SAN). A certificate with only a legacy Common Name is not sufficient for current verification.
Keep the broker’s operating system and Mosquitto current. Protect the service’s data directory and certificate directory so that ordinary users cannot read private keys.
Decide how clients will authenticate
Mosquitto 2.0 and later require an explicit choice about anonymous access. Do not leave an Internet-facing broker anonymous. Mosquitto’s documentation puts the reason plainly: “It is important to configure authentication on your Mosquitto instance, so unauthorised clients cannot connect.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Method | How it identifies a phone | Best fit | Operational cost |
|---|---|---|---|
| Password file | Each client sends a Mosquitto username and password over the TLS connection. | A few stable users or family devices. | Simple to create and rotate; you must protect and reload the password file when it changes. |
| Mutual TLS (mTLS) | Each phone presents a client certificate signed by your trusted CA. | Device-level identity and tighter control over which devices may connect. | More work: issue, install, renew, and revoke certificates for every device. |
| Anonymous | No client identity. | Only a short, isolated lab test with no untrusted network path. | Unsafe for an Internet-facing service and not a suitable production setting. |
Password authentication is usually the quickest secure option. Select mTLS when losing a password should not be enough to authorize a device, or when you need to revoke one phone without changing credentials for all the others.
Install Mosquitto and its test clients
The package names and service commands below are for Debian or Ubuntu. Other operating systems and containers use the same Mosquitto configuration concepts but may place files in different directories.
- Refresh package metadata and install the broker plus command-line clients:
sudo apt update
sudo apt install mosquitto mosquitto-clients- Enable the service at boot and start it:
sudo systemctl enable --now mosquittoBefore adding a public listener, confirm that the service account can read its configuration and data directories. Keep private keys outside locations that are writable by untrusted users, and set restrictive ownership and permissions on those files.
Create password authentication (the simplest secure deployment)
Create a password database owned by Mosquitto. The -c option creates a new file; omit it when adding another user to an existing file.
Rank #2
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
sudo mosquitto_passwd -c /etc/mosquitto/passwd phone1The command prompts for the password without echoing it. Add additional devices with:
sudo mosquitto_passwd /etc/mosquitto/passwd tablet1Restrict the file so only the broker service (and an administrator when necessary) can read it. After changing a password, reload or restart Mosquitto so the running process reads the updated file.
Prepare the certificate set for TLS
A TLS listener needs three distinct certificate assets:
- CA certificate: the trust anchor that OwnTracks uses to verify the broker certificate.
- Server certificate: identifies the broker hostname, including a SAN for the exact DNS name phones will use.
- Private key: proves possession of the server certificate and must remain secret on the host.
For mTLS, issue a separate client certificate and private key for each phone. Use different certificate subject parameters for the CA, server, and clients; reusing identical subjects can cause identity and validation problems. Do not copy the server private key to a phone.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →You can use certificates from a public certificate authority for a public DNS name or certificates from your own CA for a private deployment. If you use an ACME service with an HTTP-01 challenge, the quick-setup procedure requires the DNS name to resolve to the server’s public IP while the challenge is being completed. Plan renewals before the certificate expires and reload Mosquitto after a renewed certificate is installed.
Place the files in a directory readable by Mosquitto but not by ordinary users. The paths in the configuration must exactly match the files on your host.
Rank #3
- Includes Made in UK Raspberry Pi 3 B+ (B Plus) with 1.4 GHz 64-bit Quad-Core Processor, 1 GB RAM
- Dual Band 2.4GHz and 5GHz IEEE 802.11.b/g/n/ac Wireless LAN, Enhanced Ethernet Performance
- Includes 32 GB EVO+ Micro SD Card (Class 10) Pre-loaded with OS, USB MicroSD Card Reader
- CanaKit 2.5A USB Power Supply with Micro USB Cable and Noise Filter - Specially designed for the Raspberry Pi 3 B+ (UL Listed)
- Premium Raspberry Pi 3 B+ Case, Display Cable, 2 x Heat Sinks, GPIO Quick Reference Card, CanaKit Full Color Quick-Start Guide
Configure a TLS listener
Create a dedicated drop-in such as /etc/mosquitto/conf.d/owntracks.conf. This representative configuration uses password authentication and a conventional MQTT-over-TLS port:
allow_anonymous false
password_file /etc/mosquitto/passwd
listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.keyPort 8883 is the standard MQTT port for TLS connections. The CA file is used to build trust, while certfile and keyfile identify the server. File permissions must allow the Mosquitto service to read the key but must not expose it to other users.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Enable mutual TLS when you need device certificates
Add these directives to the TLS listener when every device should present a certificate:
require_certificate true
use_identity_as_username truerequire_certificate true makes the client certificate mandatory. use_identity_as_username true maps the certificate identity to the Mosquitto username, allowing per-device authorization and accounting. In an mTLS-only design, use certificate identity as the authentication mechanism and issue each device its own certificate package and passphrase. Keep the CA, server certificate, and client certificates distinct.
Restart Mosquitto and read the logs
Apply the configuration and immediately inspect the service:
sudo systemctl restart mosquitto
sudo systemctl status mosquitto --no-pager
sudo journalctl -u mosquitto -n 100 --no-pagerConfirm that the intended listener is bound:
sudo ss -ltnp | grep 8883A failed start is usually specific enough to diagnose from the journal. Check the path and spelling of every certificate, whether the service account can read the files, and whether another process already owns port 8883. Do not proceed to phone configuration until Mosquitto starts cleanly and remains running.
Rank #4
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- CanaKit Mega Heat Sink - Black Anodized
Connect OwnTracks to the broker
In OwnTracks, open the MQTT connection settings and enter:
- Host: the same DNS name that appears in the server certificate SAN, for example
mqtt.example.net. - Port:
8883. - CA certificate: the CA that signed the server certificate. A public-CA certificate may already be trusted by the phone; a private CA must be imported as OwnTracks allows.
- Credentials: the Mosquitto username and password created earlier, unless you selected mTLS.
For mTLS, import the client certificate and private key package into OwnTracks and supply its passphrase if one is set. The phone must trust the CA that signed the broker certificate, and the broker must trust the CA that signed the client certificate. A hostname mismatch is not fixed by changing the port: use the DNS name covered by the SAN.
Save the profile and use OwnTracks’ connection indicator or log view to verify the MQTT session. If the app reports a TLS or certificate error, first compare the host name character-for-character with the SAN and then verify that the CA file is the correct one.
Prove that a location message is flowing
Use a second terminal with the Mosquitto subscriber. The following example assumes the standard OwnTracks topic namespace; if you changed the namespace in the app, subscribe to that configured namespace instead.
mosquitto_sub
-h mqtt.example.net
-p 8883
--cafile /etc/mosquitto/certs/ca.crt
-u phone1
-P 'your-password'
-t 'owntracks/#'
-vTrigger a manual location update in OwnTracks. A JSON payload should appear in the subscriber terminal. This confirms the complete path: DNS and TCP reachability, TLS validation, authentication, publication, and subscription authorization.
When testing from the broker itself, use the same TLS settings and credentials as the phone. Avoid testing only with an unauthenticated local connection; that can hide a missing password or certificate requirement on the public listener.
Best Value
- 5 sets of code: Python (compatible with 2&3), C, Java, Scratch and Processing (Scratch and Processing code provide graphical interfaces)
- Detailed tutorial: Can be downloaded (in English, 962-page in total) or viewed online (original in English, can be translated into other languages by browsers) (The tutorial link can be found on the product box, no paper tutorial)
- 128 projects from simple to complex: Provides step-by-step guide with electronics and components knowledge, each project has schematics, wiring diagrams, complete code and detailed explanations
- 223 items in total: This ultimate kit includes the most commonly used electronic components, modules, sensors, wires and other compatible items
- Compatible models: Raspberry Pi 5 / 500 / 400 / 4B / 3B+ / 3B / 3A+ / 2B / 1B+ / 1A+ / Zero 2 W / Zero W / Zero (NOT included in this kit)
Expose the service safely outside your LAN
For a public phone connection, make only the required TLS port reachable:
- Create a DNS A or AAAA record for the broker name and verify it resolves from a mobile network.
- Forward TCP 8883 on the router to the broker’s private address, or allow TCP 8883 in the VPS firewall.
- Keep anonymous access disabled and use a unique password per device, or require client certificates.
- Do not expose the broker’s administrative files, password database, CA private key, or server private key through a web server or shared directory.
- Monitor certificate expiry and renew before the old certificate stops validating.
- Apply operating-system and Mosquitto security updates, then restart and inspect logs after configuration changes.
If your network provider blocks inbound connections or places you behind carrier-grade NAT, direct port forwarding may not work. In that case use a reachable VPS, a private VPN path, or OwnTracks’ HTTPS transport instead of publishing an MQTT port from the home network.
Free tools Windows power users keep installed
One-click scans. No signup required.
Add OwnTracks Recorder only after MQTT works
A recorder is an MQTT subscriber, not a replacement for the broker. Install and configure it after the command-line subscriber receives a real OwnTracks update. Give it a dedicated account or certificate with only the subscription permissions it needs. Keeping this stage separate makes it clear whether a problem is in Mosquitto, the phone, or the recorder.
Use HTTP mode when MQTT is not the right fit
OwnTracks can also send JSON payloads with HTTP POST to a private endpoint. This removes the need to operate an MQTT broker, but it is a different transport and deployment model. Use HTTPS; the OwnTracks documentation strongly recommends HTTPS when HTTP Basic authentication is enabled. You still need a reachable endpoint, authentication, certificate validation, and a plan for storing and processing the posted location data.
Troubleshoot by symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| Mosquitto will not start | Bad path, unreadable key or certificate, syntax error, or port already in use. | Read journalctl -u mosquitto; verify each file exists, is readable by the service, and that no other process owns 8883. |
| Phone cannot open a TCP connection | DNS, router forwarding, firewall, or provider-level inbound blocking. | Resolve the broker name from the phone’s network and check that TCP 8883 reaches the host. |
| TLS hostname or certificate error | The phone uses a name absent from the server certificate SAN, or it lacks the issuing CA. | Use the SAN-covered hostname and import the correct CA; replacing only the port will not solve a name mismatch. |
| “Not authorized” or repeated login failures | Anonymous access is disabled but credentials are wrong, the password file is not loaded, or mTLS identity is not configured as intended. | Confirm the username, reload Mosquitto after password changes, and verify client-certificate trust and identity settings. |
| Connection succeeds but no location appears | Wrong topic namespace, subscription permissions, or OwnTracks has not published a fresh update. | Subscribe to the namespace configured in the app, use verbose output, and trigger a manual update. |
| It worked, then stopped after a date | A certificate expired or renewal was installed without reloading Mosquitto. | Check certificate validity dates, install the renewed files, restart or reload the broker, and retest from the phone. |
Operational checklist
- Broker host remains online and has a stable DNS name.
- Mosquitto starts cleanly with
allow_anonymous false. - Password file or client-certificate policy is documented for every device.
- TLS listener uses port 8883, a CA file, a server certificate, and a private key.
- Server certificate SAN matches the exact hostname entered in OwnTracks.
- Private keys and password files have restrictive permissions.
- Only the required firewall or router port is exposed.
- A test subscriber receives a real OwnTracks update before a recorder is added.
- Certificate renewal, Mosquitto updates, and log checks are part of routine maintenance.
The Bottom Line
The dependable setup is a Mosquitto TLS listener on 8883 with anonymous access disabled, a correctly named server certificate, and either a protected password file or per-device client certificates. Verify the broker with a subscriber before adding Recorder; if maintaining MQTT infrastructure is undesirable, use OwnTracks over HTTPS instead.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
