AT+QSSLOPEN / HTTP(S) SSL handshake fails universally (err=579), while AT+QMTOPEN mutual TLS succeeds

## Summary

Every HTTPS/TLS connection attempt made through the HTTP(S) client (`AT+QHTTPGETEX` with the SSL context bound via `AT+QHTTPCFG=“sslctxid”`) or directly through the raw SSL socket API (`AT+QSSLOPEN`) fails during the TLS handshake. `AT+QIGETERROR` confirms this precisely: **`579, ssl handshake failed`**.

This reproduces regardless of:

- **Target server** — reproduced against our own infrastructure and against `httpbin.org` (a standard public HTTPS host with no unusual TLS requirements: no client-cert request, no renegotiation, standard cipher suites).

- **`seclevel`** — tested `0` (no validation at all), `1` (server auth only), and `2` (mutual TLS); all fail identically.

- **Certificate/key content** — the exact same cert material (CA, client cert, client key) is used successfully elsewhere on the same session (see below), ruling out bad/expired/mismatched certs.

- **AT command family** — reproduced both via `AT+QHTTPGETEX` (which reports the less specific `+QHTTPGET: 701`, HTTP(S) “unknown error”) and via `AT+QSSLOPEN` directly, bypassing the HTTP(S) client entirely.

Meanwhile, on the **same modem, same session**:

- `AT+QMTOPEN` (MQTT mutual TLS, port 8883, separate SSL context, separate AT command family) connects successfully every time.

- `AT+QHTTPGETEX` over **plain HTTP** (no TLS) to the same external hosts succeeds completely (200 response, correct body content read back via `AT+QHTTPREADFILE`/`AT+QFREAD`).

This points at something specific to how the TLS handshake is performed when driven via `AT+QSSLOPEN` / `AT+QHTTPCFG=“sslctxid”`, distinct from whatever `AT+QMTOPEN` does internally, since the latter clearly works with equivalent SSL context settings.

## Reproduction

### 1. SSL context configuration (context ID 1)

```

AT+QSSLCFG=“sslversion”,1,4

AT+QSSLCFG=“ciphersuite”,1,0XFFFF

AT+QSSLCFG=“seclevel”,1,2 // also tested with 0 and 1, no change in outcome

AT+QSSLCFG=“ignorelocaltime”,1,1

AT+QSSLCFG=“sni”,1,1

AT+QSSLCFG=“cacert”,1,“ota_ca.pem”

AT+QSSLCFG=“clientcert”,1,“ota_client.pem”

AT+QSSLCFG=“clientkey”,1,“ota_key.pem”

AT+QSSLCFG=“renegotiation”,1,1 // also tested with 0, no change in outcome

```

All of the above return `OK`.

### 2a. Reproduction via the HTTP(S) client

```

AT+QHTTPCFG=“contextid”,1

AT+QHTTPCFG=“sslctxid”,1

AT+QHTTPCFG=“contenttype”,2

AT+QHTTPCFG=“custom_header”,“Authorization:Token ”

AT+QHTTPURL=,300

AT+QHTTPCFG=“requestheader”,0

AT+QHTTPGETEX=300,0,262144

```

Result (URC, ~350–600 ms later): `+QHTTPGET: 701`

Follow-up `AT+QIGETERROR` at this point returns `0, operate successfully` — not useful for this failure path.

### 2b. Reproduction via the raw SSL socket API (bypasses the HTTP(S) client entirely)

Using the same SSL context 1 configured above:

```

AT+QSSLOPEN=1,1,0,“httpbin.org”,443

```

Result (URC, ~1.1 s later): `+QSSLOPEN: 0,579`

Follow-up `AT+QIGETERROR`:

```

+QIGETERROR: 579,ssl handshake failed

```

### What works, same session, same modem

- `AT+QMTOPEN` — MQTT mutual TLS to our broker (port 8883) — succeeds, every time.

- `AT+QHTTPGETEX` over plain HTTP (no TLS) to `httpbin.org` — succeeds, `+QHTTPGET: 0,200,402`, full response body correctly read back.

## What we’ve ruled out on our side

- **Certificate/key validity** — the same CA/client-cert/client-key material that fails here is used successfully for `AT+QMTOPEN`'s mutual TLS in the same session.

- **CA trust / seclevel** — reproduced even with `seclevel=0` (all validation disabled).

- **Server-specific TLS config or CDN quirks** — reproduced against `httpbin.org`, a plain, standard public HTTPS host, not just our own server.

- **HTTP command sequencing/parameters** — reproduced via `AT+QSSLOPEN` directly, with no `AT+QHTTPxxx` commands involved at all.

- **`renegotiation`** — tested both `1` and `0` against `httpbin.org` via `AT+QSSLOPEN`; both fail identically (`+QSSLOPEN: 0,579`, `AT+QIGETERROR: 579,ssl handshake failed`). Forcing renegotiation on was not the cause.

## Documentation checked locally (no answer found)

We checked the following against this exact failure and found nothing conclusive:

- `Quectel_EG800Q&EG91xQ_Series_SSL_Application_Note_V1.3` — Table 4 (Result Codes) only documents `` 550–574; `579` is not listed, and the table has no entry for a TLS handshake/certificate-validation-specific failure at all despite this being the SSL-specific document.

- `Quectel_EG800Q&EG91xQ_Series_TCP(IP)_Application_Note_V1.2` — same table, same range (550–574), same gap.

- `Quectel_EG800Q&EG91xQ_Series_AT_Commands_Manual_V1.1` — lists `AT+QSSLOPEN` but no extended error table.

- `Quectel_EG800Q&EG91xQ_Series_HTTP(S)_Application_Note_V1.3` — documents `701`–`730`; `701` is literally “HTTP(S) unknown error” (the generic catch-all), and every failure we’ve reproduced lands on this generic code rather than any of the more specific ones in that range (e.g. `709` network deactivated, `714` DNS error, `716` socket connect error) — suggesting the failure isn’t a routine network condition the module already knows how to classify.

## Questions for Quectel

1. Is `=579` (“ssl handshake failed” per `AT+QIGETERROR`) documented anywhere with a more specific sub-reason, or is there a debug/verbose logging mode we can enable on the module to capture the actual TLS alert or failure stage?

2. Is this a known issue on firmware `EG916QGLLGR01A05M04_A0.301.A0.301` specifically affecting `AT+QSSLOPEN` / `AT+QHTTPCFG=“sslctxid”`-driven handshakes, while `AT+QMTOPEN`'s internal TLS handling is unaffected?

3. Is there a newer firmware revision that addresses SSL/TLS handshake reliability for the HTTP(S) client or raw SSL socket API?

4. Are there any additional required `AT+QSSLCFG`/`AT+QHTTPCFG` parameters, or a required command ordering, not covered in SSL Application Note V1.3 / HTTP(S) Application Note V1.3, that could explain a handshake failure specific to these two command families?

## Environment

- Module firmware: `EG916QGLLGR01A05M04_A0.301.A0.301`

- Host MCU: Espressif ESP32-S3

- Reproducible on demand; happy to provide full AT command traces (UART logs) on request.

Dear Customer,

Thank you for providing the detailed test results.

We have checked the firmware version EG916QGLLGR01A05M04_A0.301.A0.301, and this is currently the latest firmware version for the module.

Before concluding that this is a firmware issue, we need to further isolate the SSL certificate and private-key configuration. Although the same certificate files work with AT+QMTOPEN, MQTT uses a separate SSL context. Therefore, this does not completely confirm that SSL context 1 used by AT+QSSLOPEN and HTTP(S) is configured correctly.

Please note the following:

  1. AT+QSSLCFG returning OK only confirms that the parameter was accepted. It does not confirm that the certificate file was successfully located, parsed, or matched with the private key.

  2. Changing seclevel to 0 does not remove the CA, client certificate, or client-key paths previously configured in that SSL context.

  3. The SSL application examples use the complete UFS path:

    "UFS:ota_ca.pem"
    "UFS:ota_client.pem"
    "UFS:ota_key.pem"
    
    

    Your commands currently use the filenames without the UFS: prefix.

  4. The CA certificate used for your private MQTT server may not be valid for httpbin.org. When testing httpbin.org with seclevel=1 or 2, the CA file must contain the public root CA that issued the httpbin.org server certificate.

Could you please perform the following checks?

First, confirm that all files exist and that their sizes are correct:

AT+QFLST="*"

Next, query the actual certificate paths stored in SSL context 1:

AT+QSSLCFG="cacert",1
AT+QSSLCFG="clientcert",1
AT+QSSLCFG="clientkey",1

Please then reconfigure the paths using the complete UFS filenames:

AT+QSSLCFG="cacert",1,"UFS:ota_ca.pem"
AT+QSSLCFG="clientcert",1,"UFS:ota_client.pem"
AT+QSSLCFG="clientkey",1,"UFS:ota_key.pem"

If the private key is encrypted, its password must also be provided:

AT+QSSLCFG="clientkey",1,"UFS:ota_key.pem","<key_password>"

Please do not post the actual password publicly.

To isolate the certificate configuration completely, please also test httpbin.org using a clean, unused SSL context without configuring any CA certificate, client certificate, or private key:

AT+QSSLCFG="sslversion",5,3
AT+QSSLCFG="ciphersuite",5,0xFFFF
AT+QSSLCFG="seclevel",5,0
AT+QSSLCFG="sni",5,1
AT+QSSLCFG="renegotiation",5,0
AT+QSSLOPEN=1,5,5,"httpbin.org",443,0

After receiving the +QSSLOPEN result, please immediately execute:

AT+QIGETERROR

Please also share the complete successful MQTT SSL configuration, including:

AT+QMTCFG="SSL",...
AT+QSSLCFG="cacert",...
AT+QSSLCFG="clientcert",...
AT+QSSLCFG="clientkey",...
AT+QSSLCFG="seclevel",...
AT+QSSLCFG="sslversion",...

This will allow us to compare the working MQTT SSL context with the failing HTTP/SSL context.

If the clean context test still returns error 579, we will need the complete timestamped AT log and, if possible, the module diagnostic log for further analysis.

Thank you.

Best regards,
Fazrul Redzuan

File listing (AT+QFLST="*")

+QFLST: "UFS:cacert.pem",4171
+QFLST: "UFS:client.pem",1879
+QFLST: "UFS:ota_ca.pem",4170
+QFLST: "UFS:ota_client.pem",1878
+QFLST: "UFS:ota_key.pem",3271
+QFLST: "UFS:user_key.pem",3272
OK

All expected files are present, with sizes matching exactly what was written during upload byte-for-byte. Certificate presence/corruption is not the issue.

Cert path readback on context 1 (query form)

AT+QSSLCFG="cacert",1
+QSSLCFG: "cacert",1,"ota_ca.pem"
AT+QSSLCFG="clientcert",1
+QSSLCFG: "clientcert",1,"ota_client.pem"
AT+QSSLCFG="clientkey",1
+QSSLCFG: "clientkey",1,"ota_key.pem"

The context holds exactly the paths we configured, with no truncation or silent rewriting by the module.

UFS: prefix retest

Reconfigured context 1 with explicit `UFS:` prefixes and retried against httpbin.org:

AT+QSSLCFG="cacert",1,"UFS:ota_ca.pem"
OK
AT+QSSLCFG="clientcert",1,"UFS:ota_client.pem"
OK
AT+QSSLCFG="clientkey",1,"UFS:ota_key.pem"
OK
AT+QSSLOPEN=1,1,1,"httpbin.org",443,0
OK
+QSSLOPEN: 1,579                          (~1.3s later)
AT+QIGETERROR
+QIGETERROR: 579,ssl handshake failed

Identical failure, identical timing, identical error code as with bare filenames. The UFS: prefix makes no observable difference on this firmware/context.

Clean, never-before-configured SSL context (context 5)

Using a context ID that had no prior configuration at all, with the exact parameters you specified (sslversion=3, i.e. TLS1.2-only; seclevel=0, no cert validation; no cacert/clientcert/clientkey set):

AT+QSSLCFG="sslversion",5,3
OK
AT+QSSLCFG="ciphersuite",5,0xFFFF
OK
AT+QSSLCFG="seclevel",5,0
OK
AT+QSSLCFG="sni",5,1
OK
AT+QSSLCFG="renegotiation",5,0
OK
AT+QSSLOPEN=1,5,5,"httpbin.org",443,0
OK

This did not reproduce err=579. Instead, we saw a different and much slower failure:

  • No +QSSLOPEN URC arrived within 10 seconds of the open request (vs. ~1.3s for context 1’s failure above).
  • A follow-up AT+QIGETERROR issued at the 10s mark returned 0,operate successfully — the open appeared to still be in flight, not yet resolved.
  • The +QSSLOPEN URC only arrived after we gave up and issued AT+QSSLCLOSE=5, roughly 10.5 seconds after the original open request: +QSSLOPEN: 5,567.
  • 567 (“Socket has been closed”) is a documented code in this table, unlike 579.

We can’t tell from our side whether this is a second, unrelated network/timeout condition, or a variant of the same underlying bug that manifests differently when seclevel=0 and no certs are involved.

Working MQTT SSL config, for comparison (context 0)

AT+QSSLCFG="sslversion",0,4
AT+QSSLCFG="ciphersuite",0,0XFFFF
AT+QSSLCFG="seclevel",0,1
AT+QSSLCFG="ignorelocaltime",0,1
AT+QSSLCFG="sni",0,1
AT+QSSLCFG="cacert",0,"cacert.pem"
AT+QSSLCFG="clientcert",0,"client.pem"
AT+QSSLCFG="clientkey",0,"user_key.pem"
AT+QSSLCFG="seclevel",0,2
AT+QMTCFG="ssl",0,1,0

This connects successfully every time. Note the cert paths here are also bare filenames, not UFS:-prefixed — a second, independent counter-example to the path-prefix theory on this firmware.

Final round: context history and additional hosts

To rule out two more variables — whether SSL context 1’s long reuse throughout this investigation was itself a factor, and whether something specific to our own OTA server was involved — we ran the exact same mutual-TLS configuration against a virgin, never-before-touched context and two unrelated public hosts, and repeated our no-cert-validation control test against those same hosts multiple times each.

Summary across every SSL-context/host combination tested

Config Context Host Result
Mutual TLS, seclevel=2, real certs 1 (reused throughout testing) Our OTA server 579
Mutual TLS, seclevel=2, real certs 1 (reused throughout testing) httpbin.org 579 (×2)
Mutual TLS, seclevel=2, real certs 1 (reused throughout testing) example.com 579
Mutual TLS, seclevel=2, real certs 2 (never configured before this one test) Our OTA server 579
No certs, seclevel=0 5 httpbin.org 5 of 7 attempts succeeded
No certs, seclevel=0 5 example.com 5 of 5 attempts succeeded

The mutual-TLS configuration has now failed every single time it has been attempted — 5 of 5 — across two different SSL context IDs (one reused throughout this entire investigation, one that had never been touched before) and three different hosts (our own OTA server, plus two unrelated public HTTPS hosts on different infrastructure). Context reuse, target server, and network path are all ruled out as explanations. Meanwhile a plain, no-cert-validation connection on the same modem in the same session succeeds the large majority of the time (10 of 12 attempts across the two public hosts), which rules out a blanket “this module can’t complete a TLS handshake” explanation too.
The only variable that reliably distinguishes success from failure across all of this testing is seclevel (certificate validation / mutual auth) itself.

Detail: virgin SSL context against our OTA server

AT+QSSLCFG="sslversion",2,4
AT+QSSLCFG="ciphersuite",2,0XFFFF
AT+QSSLCFG="seclevel",2,1
AT+QSSLCFG="ignorelocaltime",2,1
AT+QSSLCFG="sni",2,1
AT+QSSLCFG="cacert",2,"cacert.pem"
AT+QSSLCFG="clientcert",2,"client.pem"
AT+QSSLCFG="clientkey",2,"user_key.pem"
AT+QSSLCFG="seclevel",2,2
AT+QSSLCFG="renegotiation",2,1
AT+QSSLOPEN=1,2,2,"staging.domalys.com",443,0
OK
+QSSLOPEN: 2,579                          (~1.25s later)
AT+QIGETERROR
+QIGETERROR: 579,ssl handshake failed

Context 2 had never been configured or opened before this single test, ruling out any theory involving state accumulated on a specific, long-reused context ID.
Please find attached the logs of the test.
quectel_diag_28082026.txt (69.0 KB)

Dear Customer,

Thank you for completing the additional tests and providing the detailed log. I have reviewed the results.

The tests confirm that:

  • The certificate files are present in UFS.

  • Adding the UFS: prefix does not change the result.

  • The issue is not limited to a previously reused SSL context.

  • A clean SSL context with seclevel=0 can establish a TLS connection successfully.

I also noticed that, in the repeated clean-context test contained in the attached log, four attempts returned:

+QSSLOPEN: 5,0

while one attempt returned:

+QSSLOPEN: 5,579

Therefore, error 579 is not occurring only when certificate validation or mutual authentication is enabled. There is also an intermittent handshake failure with seclevel=0.

The earlier 567 result should not be considered a separate network or TLS failure because it was reported after AT+QSSLCLOSE=5 was issued while the SSL connection was still pending. Please wait for the +QSSLOPEN URC according to the documented response time instead of closing the connection after 10 seconds.

There is one remaining limitation in the current comparison. Testing seclevel=2 against httpbin.org or example.com does not validate mutual TLS because these public servers do not request your client certificate. In addition, the CA used for your private MQTT or OTA infrastructure may not trust the public certificates presented by these hosts.

To make a direct comparison between the MQTT and raw SSL implementations, please perform one final test against the same MQTT broker that already works with AT+QMTOPEN.

After disconnecting and closing the MQTT connection normally, do not modify SSL context 0. Use the same context, same broker hostname, same port and same certificate files:

AT+QSSLOPEN=1,0,6,"<same_MQTT_broker_hostname>",8883,0

Please wait for the final +QSSLOPEN URC. If it fails, execute immediately:

AT+QIGETERROR

Afterward, please reconnect using AT+QMTOPEN again in the same session.

This comparison will give us the following clear result:

  • If both AT+QSSLOPEN and AT+QMTOPEN succeed, the remaining issue is likely specific to the OTA server’s TLS chain or client-certificate acceptance.

  • If AT+QMTOPEN succeeds but AT+QSSLOPEN fails using the exact same SSL context, server and credentials, it will provide strong evidence of different behavior between the two internal TLS paths.

Please also verify the OTA server from a PC using the exact same files:

openssl s_client \
  -connect staging.domalys.com:443 \
  -servername staging.domalys.com \
  -tls1_2 \
  -CAfile cacert.pem \
  -cert client.pem \
  -key user_key.pem \
  -state

Please confirm that:

  • The handshake completes successfully.

  • The certificate verification result is 0 (ok).

  • The server requests and accepts the client certificate.

If possible, please provide the corresponding server-side TLS log showing the alert or reason for rejection.

Finally, the attached file is an MCU/application AT-command trace rather than the module’s internal DM diagnostic log. Since firmware EG916QGLLGR01A05M04_A0.301.A0.301 is already the latest version and error 579 does not expose a detailed sub-reason through AT commands, an internal module diagnostic log will be required if the same-endpoint comparison confirms different behaviour between AT+QMTOPEN and AT+QSSLOPEN.

Thank you.

Thank you for the detailed analysis. Here are the latest updates:

1. PC-side verification against the actual failing endpoint and CA.

Here is the test against the actual OTA host and CA we have configured on the modem (ota_ca.pem/ota_client.pem/ota_key.pem on UFS):

openssl s_client \
  -connect ota.staging.domalys.com:443 \
  -tls1_2 -servername ota.staging.domalys.com \
  -CAfile domalys_servers_L0_L1.pem -cert ota_domalys_L2.pem -key ota_domalys_L2.key \
  -state \
  -verify_return_error

Result: handshake completes, Verify return code: 0 (ok). Notably, the state trace shows the server never sends a CertificateRequest (No client certificate CA names sent, no “write certificate” step) — this endpoint does one-way (server-authenticated) TLS only and authenticates the client via an Authorization: Token ... HTTP header, not a TLS client certificate. So seclevel=2 was never actually required here.

2. We already ran the seclevel isolation you’d expect from that finding. On the modem, we tested both:

  • seclevel=2 (CA + client cert + client key uploaded and configured) — AT+QHTTPGETEX fails, +QHTTPGET: 701, AT+QIGETERROR reports 0, operate successfully, ~0.9s.
  • seclevel=1 (CA cert only, no client cert uploaded or configured — matching what the PC trace shows is actually required) — identical failure, same error, same timing.

Both fail identically regardless of whether a client cert is in play at all, which rules out the client certificate as the variable.

3. This matches a pattern already resolved on your side for this exact module. We found EG916Q-GL AT+QSSLOPEN Always Returns Error 579 — EG916Q-GL, firmware EG916QGLLGR01A05M04_A0.300.A0.300 (one revision behind our A0.301.A0.301), reporting AT+QSSLOPEN universally failing with 579 regardless of host or cert config, with PC-side OpenSSL confirmed working throughout — identical to what we’re seeing. Your team resolved that case by providing a patched firmware build. Given the match, could you confirm whether that same patch (or a newer one) applies to A0.301.A0.301, or whether a further update is available?

We’re happy to still run the same-context AT+QSSLOPEN vs AT+QMTOPEN comparison against the MQTT broker if it’s still useful alongside a firmware check — let us know.

Dear Customer,

Thank you for the additional information. This is very helpful.

Your OpenSSL result confirms that:

  • ota.staging.domalys.com supports TLS 1.2.

  • The server certificate chain validates successfully using the provided CA.

  • The server does not request a client certificate.

  • Only server authentication is required for this endpoint.

Since the module shows the same +QHTTPGET: 701 failure with both seclevel=1 using only the CA certificate and seclevel=2 using the CA, client certificate and private key, I agree that the client certificate and private key are not the cause of this HTTP(S) failure.

I also checked the previous A0.300 case you referenced. The symptom is relevant, but the behaviour is not completely identical. On A0.300, SSL connections failed universally and MQTT TLS also failed. On your A0.301 build, MQTT TLS works and some seclevel=0 raw SSL connections succeed. Therefore, I cannot confirm yet that this is exactly the same firmware defect.

EG916QGLLGR01A05M04_A0.301.A0.301 is currently the latest released firmware. I will check internally whether the patch supplied for the previous A0.300 case is already included in A0.301 and whether a newer test build or an additional SSL fix is available.

In parallel, could you please perform one final raw SSL test against the exact OTA endpoint? This will separate the underlying SSL handshake from the HTTP client, which currently only reports the generic error 701.

Please use an unused SSL context with only the required CA certificate:

AT+QSSLCFG=“sslversion”,4,3
AT+QSSLCFG=“ciphersuite”,4,0xFFFF
AT+QSSLCFG=“seclevel”,4,1
AT+QSSLCFG=“ignorelocaltime”,4,1
AT+QSSLCFG=“sni”,4,1
AT+QSSLCFG=“cacert”,4,“UFS:ota_ca.pem”
AT+QSSLCFG=“renegotiation”,4,0
AT+QSSLOPEN=1,4,4,“ota.staging.domalys.com”,443,0

Please wait for the final +QSSLOPEN URC and then execute:

AT+QIGETERROR

If this returns error 579, it will confirm that the failure occurs in the raw SSL handshake against the exact OTA endpoint, independently of the HTTP client and client certificate configuration.

If AT+QSSLOPEN succeeds but AT+QHTTPGETEX still returns 701, we will focus specifically on the HTTP(S) client configuration and request flow.

The same-context MQTT comparison is not necessary at this stage. We can request it later if needed based on the result of this exact-endpoint test.

Thank you again for the thorough testing.

Your requested exact-endpoint raw SSL test: still fails, and we now have a same-config success on different hardware

Thank you for narrowing this down. We ran exactly the test you specified — a fresh, never-before-touched SSL context (4), CA-only (seclevel=1), against the exact OTA endpoint, bypassing the HTTP(S) client entirely:


AT+QSSLCFG="sslversion",4,3
AT+QSSLCFG="ciphersuite",4,0xFFFF
AT+QSSLCFG="cacert",4,"ota_ca.pem"
AT+QSSLCFG="seclevel",4,1
AT+QSSLCFG="renegotiation",4,0
AT+QSSLOPEN=1,4,4,"ota.staging.domalys.com",443,0
OK
+QSSLOPEN: 4,579                          (\~600ms later)
AT+QIGETERROR
+QIGETERROR: 579,ssl handshake failed

This confirms your prediction: the raw SSL handshake itself fails against the exact OTA endpoint, independently of the HTTP(S) client and client-certificate configuration. 579 again, same signature as every attempt so far.

The same exact test succeeds on a EG916Q-GL EVB kit/firmware

Separately, we ran the identical test — same CA (uploaded as ca.pem), same host (ota.staging.domalys.com), same TLS1.2/CA-only/seclevel=1 configuration — on a Quectel EG916Q-GL EVB kit running EG916QGLLGR01A05M04_01.002.01.002 (a different firmware version than our module’s A0.301.A0.301):


AT+QSSLCFG="sslversion",1,3
AT+QSSLCFG="ciphersuite",1,0xFFFF
AT+QSSLCFG="cacert",1,"UFS:ca.pem"
AT+QSSLCFG="seclevel",1,1
AT+QSSLCFG="sni",1,1
AT+QSSLOPEN=1,1,0,"ota.staging.domalys.com",443,0
OK
+QSSLOPEN: 0,0                            (success)

The full HTTPS request also completed on that unit afterward (AT+QHTTPGET returned +QHTTPGET: 0,403 — a real HTTP-level response from the server, not a connection/TLS failure; two earlier attempts on that unit hit a malformed URL send and a transient 714 DNS error that looks related to a raw SSL socket from the prior test not being explicitly closed before reuse, not a TLS issue).

Why we believe this points at firmware, not our configuration

We now have the same CA, the same OTA host, and the same AT+QSSLCFG sequence producing opposite outcomes on two different EG916Q-GL units:

Firmware Result against ota.staging.domalys.com, CA-only, TLS1.2
A0.301.A0.301 (our module) AT+QSSLOPEN fails, 579 ssl handshake failed
01.002.01.002 (EVB kit) AT+QSSLOPEN succeeds (0,0); full AT+QHTTPGET also succeeds

Given your last reply mentioned checking internally “whether the patch supplied for the previous A0.300 case is already included in A0.301 and whether a newer test build or an additional SSL fix is available” — this result suggests it may not be. Could you confirm:

  1. What EG916QGLLGR01A05M04_01.002.01.002 is relative to A0.301.A0.301 — a different firmware branch, an internal/EVB-only build, or something else — and whether it (or an equivalent fix) is available for our module?
  2. If a newer/patched build is available, how we can obtain it for A0.301.A0.301-based EG916Q-GL modules.