What about a secure mqtt client

Is there already the possibility to do secure mqtt connection? Have a Pico with a wiz module for Ethernet on my desk and would like to use mqtt secure with providing CA as pem like possible as command like this:

mosquitto_sub -h  host -p 8883 -t topic --cafile /path/to/a/file

Any hints or howto?