1) Generate a CA certificate and key
sudo openssl req -new -x509 -days 3650 -extensions v3_ca -keyout mqtt_ca.key -out mqtt_ca.crt

2) Generate a server key
sudo openssl genrsa -out mqtt_server.key 2048

3) Generate a certificate signing request to send to the CA
sudo openssl req -out mqtt_server.csr -key mqtt_server.key -new

4) Send the CSR to the CA, or sign it with your CA key
sudo openssl x509 -req -in mqtt_server.csr -CA mqtt_ca.crt -CAkey mqtt_ca.key -CAcreateserial -out mqtt_server.crt -days 3650

Source: ESP8266 and mosquitto: Wificlientsecure apparently connects but after it aborts · Issue #4541 · esp8266/Arduino · GitHub