diff --git a/net/mosquitto/Makefile b/net/mosquitto/Makefile
index 4b390c5ef..93b699d0b 100644
--- a/net/mosquitto/Makefile
+++ b/net/mosquitto/Makefile
@@ -2,7 +2,7 @@
 # $FreeBSD$
 
 PORTNAME=	mosquitto
-PORTVERSION=	1.5.5
+PORTVERSION=	1.5.8
 CATEGORIES=	net
 MASTER_SITES=	http://mosquitto.org/files/source/
 
@@ -14,6 +14,7 @@ LICENSE=	EPL
 LIB_DEPENDS=	libcares.so:dns/c-ares \
 		libuuid.so:misc/e2fsprogs-libuuid
 BUILD_DEPENDS=	xsltproc:textproc/libxslt
+RUN_DEPENDS=	ca_root_nss>=0:security/ca_root_nss
 
 USES=		cmake ssl
 USE_RC_SUBR=	mosquitto
diff --git a/net/mosquitto/distinfo b/net/mosquitto/distinfo
index 2eb26e8a4..c0c4ad6bb 100644
--- a/net/mosquitto/distinfo
+++ b/net/mosquitto/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1545122205
-SHA256 (mosquitto-1.5.5.tar.gz) = fcdb47e340864c545146681af7253399cc292e41775afd76400fda5b0d23d668
-SIZE (mosquitto-1.5.5.tar.gz) = 431998
+TIMESTAMP = 1552318003
+SHA256 (mosquitto-1.5.8.tar.gz) = 78d7e70c3794dc3a1d484b4f2f8d3addebe9c2da3f5a1cebe557f7d13beb0da4
+SIZE (mosquitto-1.5.8.tar.gz) = 442834
diff --git a/net/mosquitto/files/patch-mosquitto.conf b/net/mosquitto/files/patch-mosquitto.conf
index 39a0fef7c..686c2b8d4 100644
--- a/net/mosquitto/files/patch-mosquitto.conf
+++ b/net/mosquitto/files/patch-mosquitto.conf
@@ -27,3 +27,14 @@
  
  # The maximum number of client connections to allow. This is 
  # a per listener setting.
+--- mosquitto.conf.orig	2018-12-11 11:15:06.000000000 +0000
++++ mosquitto.conf	2019-03-10 22:38:25.196966000 +0000
+@@ -211,7 +211,7 @@
+ # containing the CA certificates. For capath to work correctly, the
+ # certificate files must have ".crt" as the file ending and you must run
+ # "openssl rehash <path to capath>" each time you add/remove a certificate.
+-#cafile
++cafile /usr/local/share/certs/ca-root-nss.crt
+ #capath
+ 
+ # Path to the PEM encoded server certificate.
diff --git a/net/mosquitto/files/patch-src_mosquitto__passwd.c b/net/mosquitto/files/patch-src_mosquitto__passwd.c
index bbd83b080..79b0dd1a5 100644
--- a/net/mosquitto/files/patch-src_mosquitto__passwd.c
+++ b/net/mosquitto/files/patch-src_mosquitto__passwd.c
@@ -1,33 +1,20 @@
- lib/mosquitto_internal.h | 3 +++
- src/mosquitto_passwd.c   | 4 ++--
- src/security_default.c   | 2 +-
- 3 files changed, 6 insertions(+), 3 deletions(-)
-
---- src/mosquitto_passwd.c.orig	2018-10-11 00:27:05 UTC
-+++ src/mosquitto_passwd.c
-@@ -17,6 +17,7 @@ Contributors:
- #include "config.h"
- 
- #include <errno.h>
-+#include <openssl/opensslv.h>
- #include <openssl/evp.h>
- #include <openssl/rand.h>
- #include <openssl/buffer.h>
-@@ -99,7 +100,7 @@ int output_new_password(FILE *fptr, const char *userna
+--- src/mosquitto_passwd.c.orig	2019-03-11 15:30:29.537857000 +0000
++++ src/mosquitto_passwd.c	2019-03-11 15:31:51.079241000 +0000
+@@ -100,7 +100,7 @@
  	unsigned char hash[EVP_MAX_MD_SIZE];
  	unsigned int hash_len;
  	const EVP_MD *digest;
 -#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#ifdef HAVE_OPENSSL_OPAQUE_STRUCTS 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_OPENSSL_OPAQUE_STRUCTS)
  	EVP_MD_CTX context;
  #else
  	EVP_MD_CTX *context;
-@@ -126,7 +127,7 @@ int output_new_password(FILE *fptr, const char *userna
+@@ -127,7 +127,7 @@
  		return 1;
  	}
  
 -#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L 
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_OPENSSL_OPAQUE_STRUCTS)
  	EVP_MD_CTX_init(&context);
  	EVP_DigestInit_ex(&context, digest, NULL);
  	EVP_DigestUpdate(&context, password, strlen(password));