The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An MQTT TLS connection can fail before MQTT begins. Diagnose it in order: confirm the endpoint and DNS, establish TCP to the intended port, complete TLS negotiation and verify the broker’s certificate, present a client certificate if required, then send MQTT CONNECT and inspect the broker’s CONNACK. The furthest stage completed tells you which evidence to check next.
First identify the furthest stage your client reaches
These symptoms point to different layers. A DNS lookup failure or refused TCP socket happens before TLS. A TLS alert or certificate-verification error means the connection reached TLS but did not establish a trusted secure session. A CONNACK means TLS completed and the broker processed an MQTT CONNECT; investigate MQTT settings or broker policy rather than treating it as a TLS-handshake failure.
- No socket: verify the hostname, resolved address, route, firewall rules, listener and port.
- Socket connects, TLS fails: examine the TLS alert, protocol settings, SNI, ALPN where applicable, certificate chain and hostname verification.
- TLS succeeds, CONNACK refuses: inspect the MQTT version, client ID, credentials, identity mapping and authorization policy.
Use client and broker logs to establish what actually happened. In particular, a later disconnect is not proof that the initial TLS handshake failed. AWS IoT Core says clients must wait for CONNACK before sending additional control packets. AWS IoT Core MQTT documentation
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors1. Confirm the endpoint and resolve DNS
Record the exact hostname or address, resolved IP, port, and whether the client connects by DNS name or IP. Make sure the endpoint belongs to the intended deployment, account and region, and that the client API expects the value you supplied. AWS IoT Core SDKs require the endpoint hostname; passing a full URL where a hostname is expected can produce an invalid-hostname error. Obtain the correct endpoint from the provider or deployment configuration rather than guessing it. AWS IoT Core communication protocols
#1 Best Overall
- 【Github】github.com/Xinyuan-LilyGO/LilyGo-LoRa-Series
- 【Feature】Add the SMA and TP4054 to the board,which make it can do more things
- 【Advantage】In terms of the power switch, we have changed the switching interaction mode,SMA antenna can enhance signal transmission
- 【Paxcounter】Paxcounter is an ESP32 MCU based device for metering passenger flows in realtime. It counts how many mobile devices are around. This gives an estimation how many people are around
- 【Data transmission】Data can either be be stored on a local SD-card, transferred to cloud using LoRa WAN network or MQTT over TCP/IP, or transmitted to a local host using serial (SPI) interface
If the hostname does not resolve or resolves to an unexpected address, investigate DNS and endpoint configuration before changing MQTT credentials. If it resolves correctly but no socket is established, continue with the network path and listener.
2. Verify TCP connectivity and the listener port
A refused or timed-out TCP connection occurs before certificate validation and before MQTT CONNECT. Check that the broker is listening on the address and port the client targets, and that routing and firewall rules allow the connection. Confirm both ends expect the same transport and security mode: a broker may expose distinct listeners for plaintext MQTT, MQTT over TLS, or MQTT over WebSockets, and their ports are configuration-dependent.
Do not assume a port number or ALPN setting from one provider applies to another. AWS IoT Core’s documented default-endpoint mapping illustrates why the exact path matters:
| Default AWS IoT Core endpoint path | Authentication | Port | ALPN |
|---|---|---|---|
| MQTT over TLS | X.509 client certificate | 8883 | None listed |
| MQTT over TLS | X.509 client certificate | 443 | x-amzn-mqtt-ca |
These are AWS IoT Core settings, not universal MQTT rules; other authentication and WebSocket paths have different mappings. Check the provider’s current endpoint requirements for the exact authentication method and transport you use. AWS IoT Core communication protocols
Rank #2
- This kit comes with NodeMCU micro controller board which is based on ESP8266, an enconimcal and powerful chip which supports wifi and IDE .
- This kit is developed specially for those want to learn and play IoT ( Internet of things). In order to connect Things to Internet, for this kit, we uses a very popular and simple IOT protocol - MQTT which has many free open-source coding resources and mobile APP to help beginners to get started in an easy and economical way. Once you master MQTT, you can also buit a smarter home or something else .
- The kit includes free on-line 17 sample lessons with detailed circuit graph, step-by-step tutorial, fully-tested sample codes and video which can save lots of your time and speed up your learning progress .
- The kit is nicely packed in plastic box. This IOT programming learning starter kit includes more than 22 kinds of different electronic components items .
- The kit can not only help students make many fancy projects in science fair, hackathon and homeworks, but also prepare the necessary knowledge base for their future career path in an interesting way.
3. Diagnose TLS negotiation before MQTT
If TCP connects but TLS does not, capture the client’s TLS error and compare it with broker logs. Verify that the client and server support a compatible TLS version and cipher configuration. AWS IoT Core documents TLS 1.2 and TLS 1.3; that is an AWS service requirement, not a universal minimum for every MQTT broker. AWS IoT Core transport security
Check SNI and ALPN when the endpoint requires them
Server Name Indication (SNI) lets a TLS client indicate the hostname it is connecting to. AWS IoT Core states that non-SDK clients must send SNI and that connections without it are refused. Its documentation identifies features including multi-account registration, configurable endpoints, custom domains and VPC endpoints as using SNI. Confirm the requirement for your endpoint and client library. AWS IoT Core transport security AWS IoT Core communication protocols
Application-Layer Protocol Negotiation (ALPN) is also endpoint-specific. For AWS IoT Core X.509 MQTT on port 443, the default-endpoint table specifies x-amzn-mqtt-ca. A port, authentication or ALPN mismatch can prevent the connection from reaching MQTT CONNECT. Do not add or remove ALPN blindly; match the provider’s requirements for the chosen endpoint path. AWS IoT Core communication protocols
4. Check the broker certificate’s chain and identity separately
Certificate verification has two distinct questions: does the client trust the certificate issuer, and does the name used for the connection match the broker certificate’s Subject Alternative Name (SAN)? Passing one check does not imply passing the other.
Rank #3
- Advanced Dual-Core Performance: Unlock the full potential of your IoT projects with our 2-piece set featuring the ESP32 LoRa development board, powered by a robust dual-core ESP32-S3FN8 processor. With a clock speed of up to 240 MHz and a five-stage pipeline architecture, this board delivers high performance for complex applications and devices.
- Exceptional Connectivity: Experience seamless connectivity with integrated WiFi, LoRa, and Bluetooth capabilities. Our development board comes equipped with a dedicated 2.4GHz metal spring antenna for Wi-Fi and Bluetooth, along with an U.FL interface specifically reserved for LoRa use, ensuring stable and long-range wireless communication.
- Powerful Battery Management: This development board includes an 1100mAh battery and an onboard SH1.25-2 battery connector, featuring a comprehensive lithium battery management system. Benefit from intelligent charge and discharge management, overcharge protection, battery level detection, and automatic switching between USB and battery power for uninterrupted operation.
- Enhanced User Interface: With a 0.96-inch 128x64 dot matrix OLED display, our development board is perfect for showcasing debugging information and battery status. The Type-C USB interface ensures complete voltage regulation, ESD protection, short circuit protection, and RF shielding, enhancing safety and reliability for all your projects.
- Developer-Friendly Design: Created with developers in mind, this board supports the Ar duino development environment and includes an integrated CP2102 USB-to-serial chip for effortless programming and debugging. Coupled with excellent RF circuit design and low power consumption, it stands out as a perfect choice for scalable IoT solutions. Plus, our specially designed Meshtastic LoRa V3 case ensures compatibility and protection for your ESP32 LoRa V3 board, antenna, and 1100mAh battery (or batterie size smaller than 952540mm), making it an essential companion for your electronic endeavors.
Does the client trust the issuing CA?
Make sure the client has the appropriate CA certificate or chain in the trust store it actually uses. In its Greengrass client-device troubleshooting guidance, AWS identifies a missing CA certificate as a common cause of “Unable to verify server certificate.” That finding concerns the documented Greengrass scenario, not all MQTT deployments. AWS Greengrass client-device troubleshooting
To inspect the chain presented by the documented Greengrass listener, AWS shows this OpenSSL example:
openssl s_client -showcerts -connect <device IP>:8883Adapt the hostname or IP and port to your actual broker. Review the certificate chain the server presents and compare its issuer with the client’s configured trust material. A missing intermediate or an incorrect trust store can produce verification errors even when a certificate is presented.
Recommended Free Tools
Does the connection name match the certificate SAN?
Check the exact DNS name or IP the client uses against the certificate’s SAN. AWS describes a Greengrass case where the device IP is absent from SAN, causing server-name verification to fail. Its guidance also notes that SAN allows a TLS client to confirm it is connecting to the intended server. AWS Greengrass client-device troubleshooting
Rank #4
- 【Chip】CH9102
- 【Feature】Add the SMA and TP4054 to the board,which make it can do more things
- 【Advantage】In terms of the power switch, we have changed the switching interaction mode,SMA antenna can enhance signal transmission
- 【Github】github.com/Xinyuan-LilyGO/LilyGo-LoRa-Series
- 【Data transmission】Data can either be be stored on a local SD-card, transferred to cloud using LoRa WAN network or MQTT over TCP/IP, or transmitted to a local host using serial (SPI) interface
You can inspect a saved certificate with:
openssl x509 -in <certificate-file> -textReview its SAN and issuer information. A hostname-based connection needs a matching DNS identity; connecting by IP requires that IP identity to be covered by the certificate and supported by the client’s verification behavior. In the specific Greengrass scenario, AWS says Mbed TLS supports DNS-name verification only in SAN. Treat that as a documented library-specific case, not a rule for every embedded TLS library. AWS Greengrass client-device troubleshooting
Do not disable peer or hostname verification as a production fix. Mosquitto’s API documentation warns that disabling verification can let a malicious party impersonate the server. If used at all, disabling a check should be a tightly controlled diagnostic distinction, followed by restoring verification and correcting the trust or identity mismatch. Mosquitto API documentation
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. If mutual TLS is enabled, verify the client identity
When a broker requires mutual TLS, confirm that the client presents the intended client certificate and its matching private key, and that the broker trusts the issuing CA and accepts the certificate identity and status. The exact enrollment, activation, revocation and policy checks depend on the broker.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep CA, server and client certificates distinct. Mosquitto warns that using the same subject parameters for these roles can make it difficult for the broker or client to distinguish them. Mosquitto TLS manual
Best Value
- Working voltage: Wide voltage DC 12-28V
- Working Current : Standby current 15MA, 1 relay open 50MA, 2 relays open 85MA, 3 relays open 120MA, 4 relays open 155MA
6. Read CONNACK as an MQTT-layer response
Once TLS is established and the broker receives MQTT CONNECT, inspect whether it responds with CONNACK and note the MQTT protocol version and return or reason code. A broker reply places the failure at the MQTT layer, although the precise policy behind it depends on the broker.
| MQTT 3.1.1 CONNACK return code | Meaning documented by EMQX |
|---|---|
| 0 | Connection accepted |
| 1 | Unsupported protocol version |
| 2 | Rejected client identifier |
| 3 | Server unavailable |
| 4 | Malformed username or password |
| 5 | Unauthorized |
MQTT 5 provides more detailed reason codes, including malformed packet, protocol error, unsupported protocol version, invalid client identifier and bad username or password. These are examples from EMQX’s documentation; another broker’s policy and returned details may differ. EMQX CONNACK packet guide
After identifying the response, check the MQTT protocol version, client ID format and uniqueness policy, username/password formatting, certificate-to-client identity mapping and authorization rules. AWS IoT Core notes that two clients cannot remain connected concurrently with the same client ID: a new connection may be accepted while displacing the existing one. That can appear as repeated connect-and-disconnect behavior, rather than a TLS handshake failure. AWS IoT Core MQTT documentation
Use a known-good client to isolate application settings
If you have Mosquitto CLI available, compare it with the failing application using the same broker endpoint, port, CA material and authentication. AWS documentation demonstrates mosquitto_sub with a CA file, host, port and optional username/password to verify an EMQX broker connection. If the CLI succeeds but the application fails, compare the application’s endpoint, trust store, SNI and ALPN behavior, client certificate, MQTT version and CONNECT fields. A successful CLI test narrows the fault to differences in configuration or implementation; it does not prove that the application is using the same TLS or MQTT settings. AWS Greengrass client-device troubleshooting AWS Greengrass client-device troubleshooting
Choose the next check from the failure evidence
- DNS error or no socket: verify the configured endpoint, DNS result, route, firewall and broker listener.
- TCP works but TLS fails: inspect TLS logs, protocol compatibility, required SNI/ALPN, trusted CA chain and SAN match.
- Mutual-TLS rejection: check the presented client certificate, matching key, issuer trust and broker acceptance policy.
- CONNACK refusal: use the code to investigate MQTT version, client ID, credentials, identity mapping or authorization.
- CLI succeeds, application fails: compare the application’s endpoint, certificate handling, TLS negotiation and CONNECT fields with the working client.
Do not switch brokers simply because a connection fails. A different endpoint can help test a client stack, but it does not repair a missing CA, a SAN mismatch or incorrect MQTT CONNECT credentials.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
