...

Ignition has made it simple to load a self-signed certificate through the Setup SSL / TLS wizard but there are additional steps needed to be able to use that create and use a CA Chain certificate with the MQTT modules. 

...

Click Save to confirm the configuration update.

MQTT Modules

Create the CA Chain Certificate

Follow the procedure detailed here to How do I find the Self-Signed Certificates loaded for Ignition.

Upload Root CA Certificate

The MQTT Engine and MQTT Transmission modules will both require the Root CA Certificate chain to be upload and applied. Navigate to the Servers > Certificates section for each module and select Create New Certificate.

Browse to your Root CA Certificate chain file to upload, configure a friendly name and Save Changes.

...

Configure MQTT Distributor to use SSL/TLS

...

Navigate to the TLS section and select your certificate CA Certificate chain file as the CA Certificate File. Click Save to confirm the configuration update.

...