--- mosquitto.conf.orig	2020-12-28 13:22:44 UTC
+++ mosquitto.conf
@@ -148,7 +148,7 @@
 # This should be set to /var/run/mosquitto/mosquitto.pid if mosquitto is
 # being run automatically on boot with an init script and
 # start-stop-daemon or similar.
-#pid_file
+pid_file /var/run/mosquitto.pid
 
 # Set to true to queue messages with QoS 0 when a persistent client is
 # disconnected. These messages are included in the limit imposed by
@@ -187,7 +187,7 @@
 # If run as a non-root user, this setting has no effect.
 # Note that on Windows this has no effect and so mosquitto should be started by
 # the user you wish it to run as.
-#user mosquitto
+user nobody
 
 # =================================================================
 # Listeners
@@ -340,7 +340,7 @@
 # containing the CA certificates. For capath to work correctly, the
 # certificate files must have ".crt" as the file ending and you must run
 # "openssl rehash <path to capath>" each time you add/remove a certificate.
-#cafile
+cafile /usr/local/share/certs/ca-root-nss.crt
 #capath