$ xxd -i client.crt client_bin.crt
$ xxd -i client.key client_bin.key
$ cat client.* > certificate.h

// ------------- Includes ---------------
#include <certificate.h>
#include <PubSubClient.h>
#include <ESP8266WiFi.h>
// ------------- Wifi -------------------
const char* ssid = "SSID";
const char* password = "password";
// ------------- MQTT -------------------
const char* mqttServer = "mqtt.ranheim3r.com";
const int mqttPort = 8883;
const char* mqttTopic = "garagedoor";
const char* mqttUser = "test";
const char* mqttPassword = "1234";
// =====================================

// Set up secure comms
WiFiClientSecure espClient;
PubSubClient client(espClient);

void setup() {
  // Set up serial for debug
  Serial.begin(115200);

  // Connect to Wifi
  Serial.print("connecting to ");
  Serial.println(ssid);
  WiFi.mode(WIFI_STA);
  WiFi.begin(ssid, password);

  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }
  Serial.println("");
  Serial.println("WiFi connected");
  Serial.println("IP address: ");
  Serial.println(WiFi.localIP());

  espClient.setCertificate(client_crt, client_crt_len);
  espClient.setPrivateKey(client_key, client_key_len);

  client.setServer(mqttServer, mqttPort);
  client.setCallback(callback);

  // Init future I/O
}

void reconnect() {
  // Loop until we're reconnected
  while (!client.connected()) {
    Serial.print("Attempting MQTT connection...");
    // Attempt to connect
    if (client.connect("ESPclient", mqttUser, mqttPassword)) {
      Serial.println("connected to Mqtt broker");
      client.subscribe(mqttTopic);
    } else {
      Serial.print("failed, rc=");
      Serial.print(client.state());
      Serial.println(" try again in 5 seconds");
      // Wait 5 seconds before retrying
      delay(5000);
    }
  }
}

void loop() {
  // Connect/Reconnect to mqtt broker & subscribe
  if (!client.connected()) {
    reconnect();
  }
  client.loop();
  // Act on messages
}

void callback(char* topic, byte* payload, unsigned int length) {
  Serial.print("Message arrived [");
  Serial.print(topic);
  Serial.print("] ");
  for (int i = 0; i < length; i++) {
    Serial.print((char)payload[i]);
  }
  Serial.println();

  // Activate the door (Test using BUILTIN_LED) if an 1 was received as first character
  if ((char)payload[0] == '1') {
    digitalWrite(BUILTIN_LED, LOW);   // Turn the LED on (Note that LOW is the voltage level
    // but actually the LED is on; this is because
    // it is acive low on the ESP-01)
    delay(1000);
    digitalWrite (BUILTIN_LED, HIGH);
  } else {
    // Then nothing...
  }
}

1520115630: mosquitto version 1.4.10 (build date Mon, 29 May 2017 13:43:29 +0100) starting
1520115630: Config loaded from /etc/mosquitto/conf.d/mosquitto.conf.
1520115630: Opening ipv4 listen socket on port 8883.
1520115630: Opening ipv6 listen socket on port 8883.
1520115632: New connection from 192.168.1.170 on port 8883.
1520115632: OpenSSL Error: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate
1520115632: Socket error on client <unknown>, disconnecting.
1520115637: New connection from 192.168.1.170 on port 8883.
1520115637: OpenSSL Error: error:1417C0C7:SSL routines:tls_process_client_certificate:peer did not return a certificate
1520115637: Socket error on client <unknown>, disconnecting.

WiFi connected
IP address:
192.168.1.170
Attempting MQTT connection...failed, rc=-2 try again in 5 seconds
Attempting MQTT connection...failed, rc=-2 try again in 5 seconds

{
  "connectionProfiles" : [ {
    "recentSubscriptionTopics" : [ ],
    "recentPublishTopics" : [ ],
    "preDefinedMessages" : [ ],
    "brokerAddress" : "mqtt.ranheim3r.com",
    "brokerPort" : "8883",
    "lastPublishTopic" : null,
    "lastSubscriptionTopic" : null,
    "profileName" : "local mosquitto",
    "profileType" : "MQTT_BROKER",
    "scriptsPath" : "",
    "connectionOptions" : {
      "clientId" : "paho60251542020336",
      "connectionTimeout" : 30,
      "keepAliveInterval" : 60,
      "mqttVersionUseDefault" : true,
      "mqttVersion" : "3.1.1",
      "cleanSession" : true,
      "automaticReconnect" : true,
      "maxInflight" : 10,
      "userName" : "test",
      "password" : "1234",
      "lwtQos" : 0,
      "lwtRetained" : false,
      "lastWillDestination" : "",
      "testament" : "",
      "useProxy" : false,
      "useHttpsProxy" : false,
      "httpsProxyHost" : "",
      "httpsProxyPort" : "",
      "httpProxyHost" : "",
      "httpProxyPort" : "",
      "httpProxyUser" : "",
      "httpProxyPassword" : "",
      "httpProxyHeaderUserAgent" : "defaultClient",
      "enableSSLTLS" : true,
      "sslTlsProtocol" : "TLSv1.1",
      "certificateFilesPemFormat" : true,
      "selfCreatedCaFile" : "C:\ca.crt",
      "caFile" : "C:\ca.crt",
      "clientCertificateFile" : "C:\client2.crt",
      "clientKeyFile" : "C:\client2.key",
      "clientKeyPassword" : "",
      "useSelfCreatedCA" : false,
      "useServerSignedCertificate" : false,
      "useTrustedKeystoreFile" : false,
      "useCertificateFiles" : true,
      "useKeystoreFiles" : false,
      "clientKeystoreFilesPemFormat" : false,
      "trustedKeystoreOnlyFile" : "",
      "trustedKeystoreOnlyPassword" : "",
      "trustedKeystoreFile" : "C:\jssecacerts",
      "trustedKeystoreAlias" : "192.168.1.68",
      "trustedKeystorePassword" : "",
      "clientKeystoreFile" : "",
      "clientKeystorePassword" : "",
      "clientKeyPairAlias" : "",
      "clientKeyPairPassword" : ""
    },
    "notificatonsEnabled" : false,
    "showLastestMessagesOnly" : false,
    "lastSelectedPayloadDecoderId" : "plain_text_decoder",
    "googleCloudIotOptions" : {
      "projectId" : "ENTER-YOUR-IOT-PROJECT-ID",
      "registryId" : "ENTER-YOUR-REGISTRY-ID",
      "deviceId" : "ENTER-YOUR-DEVICE-ID",
      "cloudRegion" : "us-central1",
      "privateKeyFile" : "rsa_private_pkcs8",
      "algorithm" : "RS256",
      "mqttBridgeHostname" : "mqtt.googleapis.com",
      "mqttBridgePort" : 443
    }
  } ]
}