EC200U-CN AWS IoT TLS Handshake Failed - Error 579 / QMTOPEN 0,5 - A13M08

IoT Modules LTE Standard Module
9

Hi Quectel Support,

Thank you for providing the latest USB driver.

I was able to install the driver, enter the firmware download mode, and successfully upgrade the EC200U-CN firmware.

Firmware status

Before the upgrade:

EC200UCNAAR03A13M08

After the upgrade:

EC200UCNAAR03A17M08

I have confirmed the new firmware using:

AT+QGMR

EC200UCNAAR03A17M08

and:

ATI

Quectel
EC200U
Revision: EC200UCNAAR03A17M08
OK

So the module is now running the latest firmware you provided.

AWS IoT test after firmware upgrade

I repeated the AWS IoT test manually using AT commands, without the ESP32 application logic, to make sure the issue is not caused by our application code.

The following are working successfully:

  • AT communication

  • SIM initialization

  • LTE registration

  • PDP activation

  • DNS resolution

  • AWS endpoint reachability

  • AWS port 8883 connectivity

  • Certificate files in UFS

  • TLS configuration commands

Current signal:

AT+CSQ

+CSQ: 22,99

OK

AWS endpoint:

a7t6qe56nuogw-ats.iot.ap-south-1.amazonaws.com

PDP context is active and the AWS endpoint can be reached.

The certificate files are present:

UFS:AmazonRootCA1.pem
UFS:deviceCert.pem
UFS:privateKey.pem

The SSL context is configured as follows:

AT+QSSLCFG="cacert",2,"UFS:AmazonRootCA1.pem"
AT+QSSLCFG="clientcert",2,"UFS:deviceCert.pem"
AT+QSSLCFG="clientkey",2,"UFS:privateKey.pem"
AT+QSSLCFG="seclevel",2,2
AT+QSSLCFG="sslversion",2,3
AT+QSSLCFG="ciphersuite",2,0xFFFF
AT+QSSLCFG="sni",2,1
AT+QSSLCFG="ignorelocaltime",2,1

I also verified the configuration using the individual QSSLCFG query commands, and the modem reports the expected values.

However, the direct TLS connection still fails:

AT+QSSLOPEN=1,2,0,"a7t6qe56nuogw-ats.iot.ap-south-1.amazonaws.com",8883,0

OK

+QSSLOPEN: 0,579

Then:

AT+QIGETERROR

+QIGETERROR: 579,ssl handshake failed

OK

The same failure occurs after upgrading from:

EC200UCNAAR03A13M08

to:

EC200UCNAAR03A17M08

Current test summary

EC200U-CN firmware A13M08       : Previous firmware
EC200U-CN firmware A17M08       : Current firmware

LTE registration                : PASS
PDP / IP                        : PASS
DNS resolution                  : PASS
AWS endpoint reachability       : PASS
AWS TCP port 8883               : PASS
Certificate files               : PASS
TLS configuration               : PASS
QSSLOPEN TLS handshake          : FAIL - 579
QIGETERROR                      : 579, ssl handshake failed
MQTT QMTOPEN                    : FAIL - 0,5

Since the same TLS handshake failure is reproducible with the new A17M08 firmware and also occurs when using manual AT commands, it appears that the issue is not related to our ESP32 application code.

Could you please advise:

  1. Is EC200UCNAAR03A17M08 confirmed to support AWS IoT Core X.509 mutual TLS on port 8883?

  2. Is there any known TLS interoperability issue between A17M08 and AWS IoT Core -ats.iot endpoints?

  3. Is there a recommended QSSLCFG configuration specifically for AWS IoT Core?

  4. Is sslversion=3 or sslversion=4 recommended for this firmware?

  5. Which cipher suite should be used for AWS IoT Core?

  6. Is there any additional TLS debug/log command that can provide the actual handshake failure reason behind error 579?

  7. Is there any additional firmware/configuration required for AWS IoT Core mTLS?

I have attached the complete logs from the latest A17M08 firmware for your analysis, including both the ESP32 application test and the manual AT-command (AT commands through a serial terminal) test.

The manual AT-command test reproduces the same +QSSLOPEN: 0,579 / 579, ssl handshake failed error independently of the ESP32 application code.

Thank you.

EC200U_A17M08_AWS_IoT_TLS_Handshake_Failure_Manual_AT_Logs.zip (1.1 KB)

EC200U_A17M08_AWS_IoT_TLS_Handshake_Failure_AT_Logs.zip (1.8 KB)