Hi Quectel Support,
I am trying to connect an EC200U-CN module to AWS IoT Core using MQTT over TLS on port 8883.
I have verified that LTE connectivity, PDP context, DNS resolution, and TCP connectivity to the AWS endpoint are working. However, the TLS handshake fails with error 579, and consequently MQTT QMTOPEN returns 0,5.
Authentication: AWS IoT Core X.509 certificate-based mutual TLS (mTLS). I am using Amazon Root CA 1 for server verification, an AWS IoT X.509 device/client certificate, and its corresponding RSA private key.
Module / Network Details
Module : Quectel EC200U-CN
Firmware : EC200UCNAAR03A13M08
Host MCU : ESP32
SIM : Airtel India
APN : airtelgprs.com
AWS Region : ap-south-1
AWS IoT Port : 8883
MQTT Version : MQTT 3.1.1
1. LTE/PDP Connection – Working
The PDP context is active and the modem receives an IP address:
AT+QIACT?
+QIACT: 1,1,1,"10.xx.xx.xx"
OK
2. AWS TCP Port 8883 – Working
I tested a raw TCP connection to the same AWS IoT endpoint:
AT+QIOPEN=1,0,"TCP","xxxxxxxxxxxx-ats.iot.ap-south-1.amazonaws.com",8883,0,0
OK
+QIOPEN: 0,0
Therefore, the AWS endpoint and port 8883 are reachable from the modem.
3. Modem Time – Synchronized
I synchronized the modem using NTP:
AT+QNTP=1,"pool.ntp.org"
OK
+QNTP: 0,"2026/08/03,09:30:18+22"
AT+CCLK?
+CCLK: "26/08/03,09:30:22+22"
OK
4. AWS Certificates – Present in UFS
AT+QFLST="*"
+QFLST: "UFS:AmazonRootCA1.pem",1188
+QFLST: "UFS:deviceCert.pem",1220
+QFLST: "UFS:privateKey.pem",1679
OK
I have also generated and tested with a new AWS IoT device certificate/private-key pair, but the result is the same.
5. TLS Configuration
I am using SSL context 2:
AT+QSSLCFG="cacert",2,"UFS:AmazonRootCA1.pem"
AT+QSSLCFG="clientcert",2,"UFS:deviceCert.pem"
AT+QSSLCFG="clientkey",2,"UFS:privateKey.pem"
AT+QSSLCFG="seclevel",2,2
AT+QSSLCFG="sslversion",2,3
AT+QSSLCFG="ciphersuite",2,0xFFFF
AT+QSSLCFG="sni",2,1
AT+QSSLCFG="ignorelocaltime",2,0
All of these commands return:
OK
I have also tested sslversion=4 and ignorelocaltime=1, but the result does not change.
6. Direct TLS Test – Failing
To determine whether this was an MQTT issue or TLS issue, I tested the TLS connection directly using QSSLOPEN:
AT+QSSLOPEN=1,2,0,"xxxxxxxxxxxx-ats.iot.ap-south-1.amazonaws.com",8883,0
OK
+QSSLOPEN: 0,579
Then:
AT+QIGETERROR
+QIGETERROR: 579,ssl handshake failed
OK
Therefore, the failure appears to occur during the TLS handshake itself, before MQTT CONNECT.
7. MQTT Test
MQTT is configured as:
AT+QMTCFG="pdpcid",0,1
AT+QMTCFG="version",0,4
AT+QMTCFG="recv/mode",0,0,1
AT+QMTCFG="ssl",0,1,2
Then:
AT+QMTOPEN=0,"xxxxxxxxxxxx-ats.iot.ap-south-1.amazonaws.com",8883
OK
+QMTOPEN: 0,5
So the MQTT failure seems consistent with the TLS handshake failure above.
8. Cipher Suites Tested
AT+QSSLCFG=? shows that this firmware supports multiple TLS cipher suites.
I individually tested:
0xC02F
0xC030
0xC027
0xC028
0xFFFF
All of them still result in:
+QSSLOPEN: 0,579
+QIGETERROR: 579,ssl handshake failed
Summary
LTE registration : PASS
PDP / IP : PASS
DNS : PASS
AWS TCP port 8883 : PASS
NTP / modem time : PASS
Certificate files in UFS : PASS
TLS handshake (QSSLOPEN) : FAIL - Error 579
MQTT open (QMTOPEN) : FAIL - Result 5
The main issue appears to be:
TCP connection succeeds
↓
TLS handshake starts
↓
+QSSLOPEN: 0,579
↓
ssl handshake failed
Questions
Could you please help clarify the following?
-
Does firmware EC200UCNAAR03A13M08 fully support AWS IoT Core MQTT mutual TLS on port
8883? -
Is there any known TLS interoperability issue with this firmware and AWS IoT
-atsendpoints? -
Is any additional
QSSLCFGconfiguration required for AWS IoT Core? -
What
sslversionand cipher suite are recommended for AWS IoT Core on EC200U-CN? -
Is there a way to obtain more detailed TLS handshake/debug information for error 579?
-
Is there a newer/recommended EC200U-CN firmware for AWS IoT Core TLS support?
-
If a firmware upgrade is required, could you please provide the correct firmware package and upgrade procedure for EC200U-CN?
I can provide the complete AT-command log if required.
Thanks.
