To connect OwnTracks to a broker you control, install Mosquitto on an always-on machine, create an explicit authentication policy, configure a TLS listener (normally port 8883), and then enter that broker’s hostname, port and CA certificate in the OwnTracks app. Test publishing and subscribing before adding optional components such as OwnTracks Recorder.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Mosquitto is the MQTT broker. OwnTracks is the mobile publisher that sends location messages. A recorder or dashboard is a separate subscriber and is not required for the basic connection. For any broker reachable from the Internet, disable anonymous access and protect the connection with certificates and authentication.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Understand the OwnTracks and Mosquitto architecture
OwnTracks does not store your location history by itself on your server. The app publishes MQTT messages containing location and status data. Mosquitto receives those messages and makes them available to authorized MQTT subscribers. A recorder can subscribe later and write the messages to a database, but it is an optional layer.
- OwnTracks app: the publisher running on each phone.
- Mosquitto: the MQTT broker that accepts connections and routes messages.
- Subscriber: an MQTT client used for testing, automation or storage.
- OwnTracks Recorder: an optional subscriber and storage service added after the broker path works.
The safest order is to make one phone connect to Mosquitto, verify that a test location message arrives at a subscriber, and only then add recording or other integrations. This isolates broker, certificate and phone-configuration problems instead of debugging several services at once.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose a host and network name
Use an always-on machine
Run Mosquitto on a machine or VPS that can stay online whenever the phone needs to publish. The host can be inside your home network or on a publicly reachable server. Keep the broker’s data and configuration directories owned and protected by the service account that runs Mosquitto.
Give outside phones a stable name
If a phone will connect from outside the local network, assign the server a stable DNS name. The name is more than a convenience: it is the hostname the phone uses for TLS verification, so it must match the name in the server certificate’s Subject Alternative Name (SAN).
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPlan exposure before installing
A private, LAN-only deployment can keep the broker off the public Internet. A public deployment requires a DNS record pointing at the server, firewall and router rules that expose only the required service, and a certificate that clients can validate. If you use a Let’s Encrypt HTTP-01 challenge through the documented quick-setup approach, the DNS name must resolve to the server’s public IP while the challenge runs.
Install Mosquitto and protect its files
Install Mosquitto using the package or container method appropriate for the operating system hosting it. The exact package command differs by distribution, but the result should be the same: a Mosquitto service, a configuration directory and a service account that can read its configuration and certificates.
- Keep the broker configuration directory readable only by administrators and the Mosquitto service where possible.
- Store the password file and private keys outside user-writable directories.
- Back up configuration and certificate metadata, but do not place unencrypted private keys in a shared backup location.
- Record which operating-system service controls Mosquitto so you can restart it and inspect its logs after configuration changes.
Mosquitto 2.0 and newer require you to make an explicit authentication choice. A newly installed broker should therefore be configured deliberately rather than relying on an old anonymous default.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Choose how clients authenticate
| Method | How identity is established | Best fit | Operational cost |
|---|---|---|---|
| Password authentication | Each client supplies a username and password stored in Mosquitto’s password file. | A small, stable group of phones and other MQTT clients. | Simple to issue and replace; protect the password file and reload Mosquitto after changes. |
| Mutual TLS | The broker validates a client certificate, giving each device a certificate identity. | Deployments that need device-level credentials and stronger separation between phones. | Requires client-certificate issuance, secure key delivery, renewal and revocation procedures. |
| Anonymous access | No client credential is required. | Not suitable for an Internet-facing broker. | Provides no meaningful access control and should not be left enabled on a public listener. |
Password authentication for a small deployment
Create a Mosquitto password file with one account for each phone or service. Use a strong, unique password for every account. Set allow_anonymous false and point password_file at the protected file. When you add or change an account, preserve restrictive file permissions and reload or restart Mosquitto so it reads the updated credentials.
Mutual TLS for per-device identity
Mutual TLS adds a client certificate and private key to the phone. The broker requires that certificate and can use the certificate identity as the MQTT username with use_identity_as_username true. This gives you a separate cryptographic identity for each device, but you must keep a record of issued certificates and have a plan for replacing a lost phone or revoking a compromised key.
You can combine TLS encryption with password authentication, mutual TLS, or both according to your access-control design. Encryption protects the connection; authentication decides which clients are allowed to use it.
Create a certificate hierarchy that OwnTracks can verify
Use separate CA, server and client certificates
A TLS deployment needs a certificate authority (CA) certificate, a server certificate and the server’s private key. Mutual TLS additionally needs a client certificate and private key for each device. The Mosquitto TLS manual stresses that the CA, server and client certificates must use different certificate subject parameters. Do not copy one certificate and reuse it for every role.
- CA certificate: the trust anchor used by Mosquitto and the phone to validate certificates.
- Server certificate: identifies the Mosquitto endpoint to OwnTracks.
- Server private key: proves possession of the server certificate and must remain secret.
- Client certificate and key: required only when the broker enforces mutual TLS.
Put the hostname in the SAN
Include the broker’s DNS hostname in the server certificate’s Subject Alternative Name extension. OwnTracks notes that certificates without a SAN do not satisfy current verification requirements. A certificate whose common name merely looks correct can still fail if the hostname is absent from SAN.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Keep names and paths consistent
Use the same hostname in four places: the DNS record, the server certificate SAN, the Mosquitto listener’s intended endpoint and the hostname entered in OwnTracks. Use file paths that actually exist on the host, and make the private key readable by Mosquitto but not by ordinary users.
Configure a TLS listener in Mosquitto
Create or edit the broker configuration with an explicit authentication policy and a TLS listener. This representative fragment uses password authentication and leaves mutual TLS commented out:
allow_anonymous false
password_file /etc/mosquitto/passwd
listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
# Optional mutual TLS:
# require_certificate true
# use_identity_as_username truePort 8883 is the conventional MQTT-over-TLS port and is the port documented by OwnTracks for this setup. The three certificate settings have distinct jobs: cafile identifies the CA used for certificate validation, certfile identifies the broker, and keyfile holds the broker’s private key.
Enable mutual TLS only when you have client certificates ready
Uncomment require_certificate true only after each intended phone has a client certificate and private key that chain to the CA Mosquitto trusts. Add use_identity_as_username true when you want the certificate identity to become the MQTT username. If you are using only passwords, leave those options disabled and make sure the password file is valid.
Check permissions before starting
The Mosquitto service must be able to read the CA certificate, server certificate and private key. The private key should not be world-readable, and the directory containing it should not be writable by untrusted accounts. A path typo or an unreadable key prevents the broker from starting.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Restart Mosquitto and inspect the result
- Save the configuration and confirm that every referenced certificate, key and password-file path exists.
- Restart the Mosquitto service using the service manager provided by the host operating system.
- Inspect the service log immediately after the restart.
- Confirm that Mosquitto parsed the configuration and bound the intended TLS listener on port 8883.
A failed start commonly points to an unreadable certificate or private key, a bad path, malformed configuration, or another process already using the port. Fix the first error shown in the log, then restart and inspect the log again. Do not proceed to phone configuration until the listener is confirmed.
Configure OwnTracks on the phone
Enter the broker endpoint
- Open the broker settings in OwnTracks.
- Enter the broker’s DNS hostname, not an unrelated alias or raw address that is absent from the certificate SAN.
- Set the port to 8883 for the TLS listener.
- Provide the CA certificate that signed the Mosquitto server certificate.
- Enter the MQTT username and password if you selected password authentication.
- If mutual TLS is enabled, import the client certificate and private key package and enter its passphrase when OwnTracks requests it.
- Save the settings and use OwnTracks’ connection check or status indicator to verify the broker connection.
The hostname must match the server certificate’s SAN exactly. A successful TCP connection is not enough: OwnTracks also has to trust the CA, validate the certificate name and complete MQTT authentication.
Protect the phone credentials
Treat the MQTT password or client private key as a device credential. Do not paste a private key into a shared note or send it through an unprotected channel. If a phone is lost, remove or change its password account, or revoke and replace its client certificate according to your chosen authentication method.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Verify publishing before adding a recorder
Use a separate MQTT client on the server or another trusted machine to subscribe to the OwnTracks topic namespace. Then trigger a test location update from the phone and confirm that a message arrives. This proves the complete path: DNS, firewall, TLS validation, authentication, OwnTracks publishing and broker routing.
- Start a subscriber with credentials accepted by Mosquitto.
- Subscribe to the OwnTracks topic namespace rather than guessing a single topic.
- Move the phone or trigger a manual update so OwnTracks publishes a fresh location message.
- Check that the subscriber receives the message and that its timestamp and location fields are plausible.
- Repeat once from the phone’s mobile network if the broker is intended for public access; a LAN-only test does not prove that router forwarding and external firewall rules work.
Only after this test succeeds should you install OwnTracks Recorder or another storage consumer. The recorder is a subscriber; it cannot repair a broker that is not accepting and routing messages.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Expose a public broker without making it public to everyone
Limit network exposure
Forward or permit only the port required for the TLS listener. Apply firewall rules at the host and, for a home server, at the router. Avoid exposing administrative interfaces or unrelated services alongside Mosquitto.
Keep anonymous access disabled
Internet-facing Mosquitto instances should use allow_anonymous false and an explicit authentication method. The Mosquitto documentation states: “It is important to configure authentication on your Mosquitto instance, so unauthorised clients cannot connect.” A reachable broker with anonymous publishing can be abused to inject, observe or disrupt messages.
Recommended Free Tools
Use a real certificate and monitor its lifetime
Install a certificate whose SAN contains the public DNS name and whose chain is trusted by the phone. Track the certificate’s expiration date and renew it before it expires. After renewal, verify the listener and an OwnTracks connection again; a replaced certificate or key can expose a path or permission error that was not present before.
Keep software current
Update Mosquitto and the host operating system through their normal maintenance process. Review changes to authentication and TLS settings after an upgrade, and keep backups of the configuration without exposing private keys.
Troubleshoot by symptom
Mosquitto will not start
- Read the service log for the first reported error.
- Check that
cafile,certfile,keyfileandpassword_filepoint to real files. - Check ownership and permissions; the Mosquitto service account must be able to read the files.
- Check whether another process already occupies port 8883.
- Validate certificate and key pairing. A server certificate and private key from different issuances will not work together.
OwnTracks reports a certificate or hostname error
- Use the DNS name in the certificate SAN as the broker hostname in OwnTracks.
- Confirm that the phone has the correct CA certificate.
- Replace a server certificate that lacks SAN; a common-name-only certificate does not satisfy current OwnTracks verification.
- Check the phone’s date and time, because certificate validity depends on correct time.
The TLS connection succeeds but authentication fails
- For password mode, verify the username and password and confirm that Mosquitto loaded the current password file after your last change.
- For mutual TLS, confirm that the client certificate chains to the configured CA, has not expired and is accompanied by its private key and passphrase.
- Check that you did not enable
require_certificate truefor clients that have only password credentials.
The phone connects but no location message appears
- Confirm that the test subscriber is connected with an account permitted to subscribe.
- Subscribe to the full OwnTracks topic namespace while testing.
- Trigger a new location update rather than waiting for an older cached message.
- Inspect Mosquitto logs for an accepted connection followed by a publish or disconnect.
- Test from the same network first, then from the mobile network, to separate broker problems from router or firewall problems.
Use HTTP mode when MQTT is not the right transport
OwnTracks also supports HTTP mode. In that design, the app sends JSON payloads with HTTP POST requests to a private endpoint instead of connecting to an MQTT broker. It can be useful when you do not want to operate Mosquitto, but it is a different deployment path with different authentication and routing decisions.
When HTTP Basic authentication is used, OwnTracks documentation strongly recommends HTTPS. Do not send Basic credentials over an unencrypted connection. HTTP mode also means you must provide and secure the receiving endpoint yourself; the MQTT listener, subscriber and topic checks described above do not apply.
Quick Recap
Maintain the deployment after it works
- Keep a written inventory of each phone’s username or client certificate identity.
- Remove credentials for retired or lost devices.
- Monitor Mosquitto logs for repeated authentication failures and unexpected connection sources.
- Check certificate expiration dates before they become urgent.
- After any DNS, firewall, certificate or Mosquitto configuration change, repeat a publish-and-subscribe test.
- Add OwnTracks Recorder only with a subscriber account that has the minimum permissions it needs.
Deployment checklist
- An always-on host runs Mosquitto and protects its configuration and data directories.
- A stable DNS name resolves to the host when phones connect from outside the LAN.
- Mosquitto has an explicit authentication policy; anonymous access is disabled for public use.
- The CA, server certificate and private key are separate files, and certificate subjects are not reused across roles.
- The server certificate contains the broker hostname in its SAN.
- A TLS listener is configured on port 8883 with valid
cafile,certfileandkeyfilepaths. - The Mosquitto service starts cleanly and binds the expected listener.
- OwnTracks has the matching hostname, port and CA certificate, plus password or client-certificate credentials as required.
- A test subscriber receives an OwnTracks location message before any recorder is added.
- Firewall, DNS, software updates, credential rotation and certificate renewal have an owner and a documented procedure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
