So with some further testing I had to do the following. ( the conf info is from the setup link, I haven't played with those settings much but these worked)
The mosquitto conf :
port 1883
allow_anonymous false
password_file /etc/mosquitto/passwords.txt
log_type information
listener 8883
protocol mqtt
cafile /root/py/mqSecurity/certs/mosq-ca.crt
certfile /root/py/mqSecurity/certs/mosq-serv.crt
keyfile /root/py/mqSecurity/certs/mosq-serv.key
Using Wireshark to capture the conversation, when we use port 8883 I cannot see the username and password in the message like I did when I used port 1883 so encryption seems to be working.
What I had to do in the micropython client is summarized below:
I set the following variables - remember the server name had to be in the hosts file when I created the ssl keys and certs.
SERVER = "mos_broker"
PORT=8883
USER = "Thing01"
PASSWORD = "Thing01"
SSL_PARAMS = {"ca_certs":"./certs/mosq-ca.crt"}
TOPIC = "data"
For the client connection I used the following:
c = MQTTClient("OmegaDashD2E2", user=USER, password=PASSWORD, server=SERVER, ssl_params=SSL_PARAMS)
(if anyone is interested in the full code, contact me and I can send it however I got it from the MQTT.simple example on the git page)
So this seems to work fine, and can handle the encrypted data sent/received from my mac however I found the following behavior.
NOTE:
I could not remove port 1883 from the config file and when a client sends an unencrypted post to port 1883, the subscriber also sees that and prints it. I see the same behavior in mqtt.fx subscriber so it may be mosquitto broker behavior.
What his means is that any connection to that port (1883) may expose usernames, passwords and topics.
I couldn't force the micropython subscriber to use only port 8883, I keep getting errors about too many parameters being sent to the MQTTClient() back end code.
So for security, do not use port 1883 and your username/password along with the topic should be hidden from any general snooping.
I will test out publishing from the Omega in the future.