让 Nginx 负责 TLS 加密后端 Mosquitto 保持明文既省事又安全。✅ 推荐做法Nginx 终结 TLS再把解密后的 MQTT 流量转发给 Mosquitto。适用场景客户端走wss://或mqtts://连接 Nginx443/8883 端口Nginx 解密后转发到 Mosquitto 的明文端口如 1883 或 WebSocket 端口。好处证书统一在 Nginx 管理不用在 Mosquitto 单独配证书还能顺带用上 Nginx 的连接数限制、IP 黑名单等防护。注意点Nginx 必须开启proxy_http_version 1.1和Upgrade头否则 MQTT 心跳会被截断导致频繁掉线如果走 TCP 代理非 WebSocket要用stream模块而不是http模块。⚠️ 一个关键前提这种架构只保护了客户端到 Nginx 这一段。如果 Mosquitto 和 Nginx 在同一台内网机器上问题不大LS 加密。Mosquitto x86_64 本地编译 aarch64 交叉编译完整步骤环境说明宿主Ubuntu 22.04x86_64交叉工具链buildroot 产出aarch64-buildroot-linux-gnuMosquitto 版本2.0.x2.0.18 推荐需要 OpenSSL3.0 开启 TLS可以关闭 WITH_TLS 去除 openssl 依赖解决你刚才链接报错编译系统CMakemosquitto 2.x 推荐 CMake不再主推 makefile⚠️重点WITH_TLSON → 依赖 OpenSSLWITH_TLSOFF → 无 openssl 依赖适合内网 MQTT规避你前面libssl.so.3缺失问题前置依赖宿主 Ubuntu x86_64 统一安装前置依赖宿主 Ubuntu x86_64 统一安装sudo apt update sudo apt install cmake gcc g libssl-dev libcjson-dev git pkg-configlibssl-dev 是 x86_64 本地编译 openssl 依赖交叉编译的 OpenSSL 由 buildroot 工具链 sysroot 提供。第一部分x86_64 本地编译 MosquittoUbuntu 主机1. 获取源码git clone https://github.com/eclipse/mosquitto.git cd mosquitto git checkout v2.0.18 mkdir build-x86_64 cd build-x86_642. CMake 配置2 种选项二选一选项 1启用 TLS需要 opensslcmake .. \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-x86 \ -DWITH_TLSON \ -DWITH_TLS_PSKON \ -DWITH_THREADINGON \ -DWITH_CJSONOFF选项 2关闭 TLS无 openssl 依赖调试推荐不会出现 ssl 符号报错cmake .. \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-x86 \ -DWITH_TLSOFF \ -DWITH_THREADINGON \ -DWITH_CJSONOFF3. 编译 安装make -j$(nproc) sudo make install4. 验证# 查看编译产出 ls /opt/mosquitto/build-x86/lib/ # 查看依赖 ldd /opt/mosquitto/build-x86/lib/libmosquitto.so第二部分aarch64 交叉编译 Mosquittobuildroot aarch64 工具链前提你已经拥有 buildroot 生成的完整 aarch64 SDK路径/opt/aarch64-buildroot-linux-gnu_sdk-buildroot/工具链前缀aarch64-buildroot-linux-gnu-步骤 1准备交叉编译工具链文件 toolchain-aarch64.cmake在 mosquitto 源码根目录新建toolchain-aarch64.cmakeset(CMAKE_SYSTEM_NAME Linux) set(CMAKE_SYSTEM_PROCESSOR aarch64) # buildroot sdk根目录 set(SDK_ROOT /opt/aarch64-buildroot-linux-gnu_sdk-buildroot) # 编译器完整路径 set(CMAKE_C_COMPILER ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-gcc) set(CMAKE_CXX_COMPILER ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-g) set(CMAKE_AR ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-ar) set(CMAKE_RANLIB ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-ranlib) # sysroot路径 set(CMAKE_SYSROOT ${SDK_ROOT}/aarch64-buildroot-linux-gnu/sysroot) set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)第二步清理旧构建缓存重新 cmakecd mosquitto rm -rf build-aarch64 mkdir build-aarch64 cd build-aarch64继续使用WITH_TLSOFF规避 OpenSSL3 依赖解决你最开始链接报错cmake .. \ -DCMAKE_TOOLCHAIN_FILE../toolchain-aarch64.cmake \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 \ -DWITH_TLSOFF \ -DWITH_THREADINGON \ -DWITH_CJSONOFFmake -j$(nproc) sudo make install第三步校验编译产物# 检查架构必须输出 AArch64 aarch64-buildroot-linux-gnu-readelf -h /opt/mosquitto/build-aarch64/lib/libmosquitto.so # 检查依赖WITH_TLSOFF 不会出现 libssl.so.3 aarch64-buildroot-linux-gnu-readelf -d /opt/mosquitto/build-aarch64/lib/libmosquitto.so备选方案使用 buildroot 自带 environment‑setup 脚本不手写 toolchainbuildroot sdk 自带环境脚本environment-setup可以不用手写 toolchain 文件cd /opt/aarch64-buildroot-linux-gnu_sdk-buildroot source environment-setup cd mosquitto rm -rf build-aarch64 mkdir build-aarch64 cd build-aarch64 cmake .. \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 \ -DWITH_TLSOFF \ -DWITH_THREADINGON \ -DWITH_CJSONOFF make -j$(nproc) sudo make installsource 之后$CC$CXX$CFLAGS$LDFLAGS全部自动配置好适合不想维护 toolchain 文件的场景Buildroot。常见踩坑不要自己拼接-gnubuildroot sdk bin 目录下直接就是aarch64-buildroot-linux-gnu-gcc。每次修改 toolchain 文件必须删除 build 目录全部缓存否则 cmake 继续读取旧缓存。确认 SDK 没有解压损坏source environment-setup无报错。ls /opt/aarch64-buildroot-linux-gnu_sdk-buildroot/bin/ ls /opt/aarch64-buildroot-linux-gnu_sdk-buildroot/aarch64-buildroot-linux-gnu/若要开启TLS则开启 TLS要求 buildroot sysroot 内必须存在 libssl.so.3 /libcrypto.so.3否则编译出来的 libmosquitto.so 链接失败cmake .. \ -DCMAKE_TOOLCHAIN_FILE../toolchain-aarch64.cmake \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 \ -DWITH_TLSON \ -DWITH_TLS_PSKON \ -DWITH_THREADINGON \ -DWITH_CJSONOFF集成到Qt 工程CMake以xxx项目为例# 引入mosquitto头文件与库目录 include_directories(/opt/mosquitto/build-aarch64/include) link_directories(/opt/mosquitto/build-aarch64/lib) target_link_libraries(PTU_Manager mosquitto cjson Qt5::Core Qt5::Network pthread rt dl )✅关闭 TLS 版本不需要-lssl -lcrypto》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》若TLS不要sqlite不要websockets不要Openssl不要最简单的编译安装mosquitto的流程如下:1、先编译安装x86_64环境下的cjson编译产物存放到/opt/cjson/build-x86目录下2、再编译安装aarch64交叉编译环境下的cjson编译产物存放到/opt/cjson/build-aarch64目录下3、编译安装x86_64环境下的mosquitto:rm -rf * cmake .. \ -DWITH_TLSOFF \ -DWITH_WEBSOCKETSOFF \ -DWITH_TESTSOFF \ -DWITH_DLTOFF \ -DWITH_PLUGIN_PERSIST_SQLITEOFF \ -DWITH_ARGON2OFF \ -DCJSON_INCLUDE_DIR/opt/cjson/build-x86/include \ -DCJSON_LIBRARY/opt/cjson/build-x86/lib/libcjson.so \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-x86 make -j$(nproc) sudo make install4、编译安装aarch64交叉编译环境下的mosquittorm -rf * cmake .. \ -DCMAKE_C_COMPILERaarch64-linux-gnu-gcc \ -DCMAKE_CXX_COMPILERaarch64-linux-gnu-g \ -DWITH_TLSOFF \ -DWITH_WEBSOCKETSOFF \ -DWITH_TESTSOFF \ -DWITH_DLTOFF \ -DWITH_PLUGIN_PERSIST_SQLITEOFF \ -DWITH_ARGON2OFF \ -DCJSON_INCLUDE_DIR/opt/cjson/build-aarch64/include \ -DCJSON_LIBRARY/opt/cjson/build-aarch64/lib/libcjson.so \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 make -j$(nproc) sudo make install 
长河君 · 2026/11/5 1:50:39 · 阅读 1.2k mosquitto的x86_64和aarc64的编译 -DWITH_TLS=OFF
让 Nginx 负责 TLS 加密后端 Mosquitto 保持明文既省事又安全。✅ 推荐做法Nginx 终结 TLS再把解密后的 MQTT 流量转发给 Mosquitto。适用场景客户端走wss://或mqtts://连接 Nginx443/8883 端口Nginx 解密后转发到 Mosquitto 的明文端口如 1883 或 WebSocket 端口。好处证书统一在 Nginx 管理不用在 Mosquitto 单独配证书还能顺带用上 Nginx 的连接数限制、IP 黑名单等防护。注意点Nginx 必须开启proxy_http_version 1.1和Upgrade头否则 MQTT 心跳会被截断导致频繁掉线如果走 TCP 代理非 WebSocket要用stream模块而不是http模块。⚠️ 一个关键前提这种架构只保护了客户端到 Nginx 这一段。如果 Mosquitto 和 Nginx 在同一台内网机器上问题不大LS 加密。Mosquitto x86_64 本地编译 aarch64 交叉编译完整步骤环境说明宿主Ubuntu 22.04x86_64交叉工具链buildroot 产出aarch64-buildroot-linux-gnuMosquitto 版本2.0.x2.0.18 推荐需要 OpenSSL3.0 开启 TLS可以关闭 WITH_TLS 去除 openssl 依赖解决你刚才链接报错编译系统CMakemosquitto 2.x 推荐 CMake不再主推 makefile⚠️重点WITH_TLSON → 依赖 OpenSSLWITH_TLSOFF → 无 openssl 依赖适合内网 MQTT规避你前面libssl.so.3缺失问题前置依赖宿主 Ubuntu x86_64 统一安装前置依赖宿主 Ubuntu x86_64 统一安装sudo apt update sudo apt install cmake gcc g libssl-dev libcjson-dev git pkg-configlibssl-dev 是 x86_64 本地编译 openssl 依赖交叉编译的 OpenSSL 由 buildroot 工具链 sysroot 提供。第一部分x86_64 本地编译 MosquittoUbuntu 主机1. 获取源码git clone https://github.com/eclipse/mosquitto.git cd mosquitto git checkout v2.0.18 mkdir build-x86_64 cd build-x86_642. CMake 配置2 种选项二选一选项 1启用 TLS需要 opensslcmake .. \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-x86 \ -DWITH_TLSON \ -DWITH_TLS_PSKON \ -DWITH_THREADINGON \ -DWITH_CJSONOFF选项 2关闭 TLS无 openssl 依赖调试推荐不会出现 ssl 符号报错cmake .. \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-x86 \ -DWITH_TLSOFF \ -DWITH_THREADINGON \ -DWITH_CJSONOFF3. 编译 安装make -j$(nproc) sudo make install4. 验证# 查看编译产出 ls /opt/mosquitto/build-x86/lib/ # 查看依赖 ldd /opt/mosquitto/build-x86/lib/libmosquitto.so第二部分aarch64 交叉编译 Mosquittobuildroot aarch64 工具链前提你已经拥有 buildroot 生成的完整 aarch64 SDK路径/opt/aarch64-buildroot-linux-gnu_sdk-buildroot/工具链前缀aarch64-buildroot-linux-gnu-步骤 1准备交叉编译工具链文件 toolchain-aarch64.cmake在 mosquitto 源码根目录新建toolchain-aarch64.cmakeset(CMAKE_SYSTEM_NAME Linux) set(CMAKE_SYSTEM_PROCESSOR aarch64) # buildroot sdk根目录 set(SDK_ROOT /opt/aarch64-buildroot-linux-gnu_sdk-buildroot) # 编译器完整路径 set(CMAKE_C_COMPILER ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-gcc) set(CMAKE_CXX_COMPILER ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-g) set(CMAKE_AR ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-ar) set(CMAKE_RANLIB ${SDK_ROOT}/bin/aarch64-buildroot-linux-gnu-ranlib) # sysroot路径 set(CMAKE_SYSROOT ${SDK_ROOT}/aarch64-buildroot-linux-gnu/sysroot) set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY) set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY) set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)第二步清理旧构建缓存重新 cmakecd mosquitto rm -rf build-aarch64 mkdir build-aarch64 cd build-aarch64继续使用WITH_TLSOFF规避 OpenSSL3 依赖解决你最开始链接报错cmake .. \ -DCMAKE_TOOLCHAIN_FILE../toolchain-aarch64.cmake \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 \ -DWITH_TLSOFF \ -DWITH_THREADINGON \ -DWITH_CJSONOFFmake -j$(nproc) sudo make install第三步校验编译产物# 检查架构必须输出 AArch64 aarch64-buildroot-linux-gnu-readelf -h /opt/mosquitto/build-aarch64/lib/libmosquitto.so # 检查依赖WITH_TLSOFF 不会出现 libssl.so.3 aarch64-buildroot-linux-gnu-readelf -d /opt/mosquitto/build-aarch64/lib/libmosquitto.so备选方案使用 buildroot 自带 environment‑setup 脚本不手写 toolchainbuildroot sdk 自带环境脚本environment-setup可以不用手写 toolchain 文件cd /opt/aarch64-buildroot-linux-gnu_sdk-buildroot source environment-setup cd mosquitto rm -rf build-aarch64 mkdir build-aarch64 cd build-aarch64 cmake .. \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 \ -DWITH_TLSOFF \ -DWITH_THREADINGON \ -DWITH_CJSONOFF make -j$(nproc) sudo make installsource 之后$CC$CXX$CFLAGS$LDFLAGS全部自动配置好适合不想维护 toolchain 文件的场景Buildroot。常见踩坑不要自己拼接-gnubuildroot sdk bin 目录下直接就是aarch64-buildroot-linux-gnu-gcc。每次修改 toolchain 文件必须删除 build 目录全部缓存否则 cmake 继续读取旧缓存。确认 SDK 没有解压损坏source environment-setup无报错。ls /opt/aarch64-buildroot-linux-gnu_sdk-buildroot/bin/ ls /opt/aarch64-buildroot-linux-gnu_sdk-buildroot/aarch64-buildroot-linux-gnu/若要开启TLS则开启 TLS要求 buildroot sysroot 内必须存在 libssl.so.3 /libcrypto.so.3否则编译出来的 libmosquitto.so 链接失败cmake .. \ -DCMAKE_TOOLCHAIN_FILE../toolchain-aarch64.cmake \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 \ -DWITH_TLSON \ -DWITH_TLS_PSKON \ -DWITH_THREADINGON \ -DWITH_CJSONOFF集成到Qt 工程CMake以xxx项目为例# 引入mosquitto头文件与库目录 include_directories(/opt/mosquitto/build-aarch64/include) link_directories(/opt/mosquitto/build-aarch64/lib) target_link_libraries(PTU_Manager mosquitto cjson Qt5::Core Qt5::Network pthread rt dl )✅关闭 TLS 版本不需要-lssl -lcrypto》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》》若TLS不要sqlite不要websockets不要Openssl不要最简单的编译安装mosquitto的流程如下:1、先编译安装x86_64环境下的cjson编译产物存放到/opt/cjson/build-x86目录下2、再编译安装aarch64交叉编译环境下的cjson编译产物存放到/opt/cjson/build-aarch64目录下3、编译安装x86_64环境下的mosquitto:rm -rf * cmake .. \ -DWITH_TLSOFF \ -DWITH_WEBSOCKETSOFF \ -DWITH_TESTSOFF \ -DWITH_DLTOFF \ -DWITH_PLUGIN_PERSIST_SQLITEOFF \ -DWITH_ARGON2OFF \ -DCJSON_INCLUDE_DIR/opt/cjson/build-x86/include \ -DCJSON_LIBRARY/opt/cjson/build-x86/lib/libcjson.so \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-x86 make -j$(nproc) sudo make install4、编译安装aarch64交叉编译环境下的mosquittorm -rf * cmake .. \ -DCMAKE_C_COMPILERaarch64-linux-gnu-gcc \ -DCMAKE_CXX_COMPILERaarch64-linux-gnu-g \ -DWITH_TLSOFF \ -DWITH_WEBSOCKETSOFF \ -DWITH_TESTSOFF \ -DWITH_DLTOFF \ -DWITH_PLUGIN_PERSIST_SQLITEOFF \ -DWITH_ARGON2OFF \ -DCJSON_INCLUDE_DIR/opt/cjson/build-aarch64/include \ -DCJSON_LIBRARY/opt/cjson/build-aarch64/lib/libcjson.so \ -DCMAKE_INSTALL_PREFIX/opt/mosquitto/build-aarch64 make -j$(nproc) sudo make install