https://mosquitto.org/man/mosquitto-tls-7.html
在按照mosquitto官方的mqtt tls双向验证配置时，总是会报self-signed certificate问题，一般我们验证生成的server.crt不会报，但client.crt总是验证失败。可以参照下面的解决方案：
（1)在生成服务器的证书前

先生成一个openssl.cnf，填入以下内容：

[req]
default_bits  = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
countryName = CN
stateOrProvinceName = Zhejiang
localityName = Hangzhou
organizationName = EMQX
commonName = CA
[req_ext]
subjectAltName = @alt_names
[v3_req]
subjectAltName = @alt_names
[alt_names]
IP.1 = BROKER_ADDRESS
DNS.1 = BROKER_ADDRESS

上面IP和DNS保留一个即可
替换成自己的
然后再执行下面命令生成server证书，

openssl req -new -key ./emqx.key -config openssl.cnf -out emqx.csr

然后再按官网的步骤往下走就行了；
最后只要你验证：

lzs@lzs-Precision-3591:~/workspace/tmp/mqtt_demo123/mqtt_demo/TLS$ openssl verify -CAfile ca.crt server.crt 
server.crt: OK
lzs@lzs-Precision-3591:~/workspace/tmp/mqtt_demo123/mqtt_demo/TLS$ openssl verify -CAfile ca.crt client.crt 
client.crt: OK

就没问题