--- mosquitto.conf.orig	2025-03-06 16:25:31 UTC
+++ mosquitto.conf
@@ -167,7 +167,7 @@
 # This should be set to /var/run/mosquitto/mosquitto.pid if mosquitto is
 # being run automatically on boot with an init script and
 # start-stop-daemon or similar.
-#pid_file
+pid_file /var/run/mosquitto.pid
 
 # Set to true to queue messages with QoS 0 when a persistent client is
 # disconnected. These messages are included in the limit imposed by
@@ -206,7 +206,7 @@
 # If run as a non-root user, this setting has no effect.
 # Note that on Windows this has no effect and so mosquitto should be started by
 # the user you wish it to run as.
-#user mosquitto
+user nobody
 
 # =================================================================
 # Listeners
@@ -360,7 +360,7 @@
 # certificate files must have ".crt" as the file ending and you must run
 # "openssl rehash <path to capath>" each time you add/remove a certificate.
 # capath is not supported for websockets.
-#cafile
+cafile /usr/local/share/certs/ca-root-nss.crt
 #capath