EG21-G MQTT over SSL/TLS with AWS IoT – SSL Configuration Causes QMTOPEN Failure

IoT Modules LTE Standard Module
,
1

Hello,
I am facing a persistent issue when connecting my Quectel EG21-G module to AWS IoT Core using MQTT over SSL/TLS. I have verified that my AWS configuration, certificates, and policies are fully correct, because the same certificates work perfectly on Node-RED and MQTT Explorer.

However, when using the EG21-G, the module behaves inconsistently depending on how SSL is configured.

Problem Description (Technical Details)

1. MQTT broker opens successfully only when SSL is NOT configured using QMTCFG

If I reset the module and simply do:

AT+QMTOPEN=0,"a2l9aypytopjpa-ats.iot.ap-south-1.amazonaws.com",8883

I get:

OK
+QMTOPEN: 0,0

But when I attempt to connect:

AT+QMTCONN=0,"clientID"

I get:

+QMTCONN: 0,1
+QMTSTAT: 0,3   (Connection failed)

This means the port opens, but the SSL handshake fails afterward.

2. MQTT broker FAILS TO OPEN when SSL is configured using QMTCFG

If I configure SSL using:

AT+QMTCFG="ssl",0,1,2

OR

AT+QMTCFG="ssl",0,2

THEN execute:

AT+QMTOPEN=0,"a2l9aypytopjpa-ats.iot.ap-south-1.amazonaws.com",8883

I always get:

OK
+QMTOPEN: 0,-1

So the module cannot even open the MQTT socket once SSL parameters are linked to MQTT using QMTCFG.

3. Certificates are correctly uploaded and detected

AT+QFLST
"rootca.pem",1189
"client.pem",1222
"private.pem",1677

I am using:

QSSLCFG index = 0
QMTCFG index = 0

4. SSL configuration that succeeds (only for QMTOPEN)

If I configure SSL but DO NOT link it with QMTCFG, like:

AT+QSSLCFG="sslversion",0,4
AT+QSSLCFG="seclevel",0,2
AT+QSSLCFG="cacert",0,"rootca.pem"
AT+QSSLCFG="clientcert",0,"client.pem"
AT+QSSLCFG="clientkey",0,"private.pem"

and then:

AT+QMTCFG="ssl",0,0

Then:

AT+QMTOPEN = successful
AT+QMTCONN = always fails (QMTSTAT 3)

5. Summary of the Issue

:check_mark: Certificates are correct

(Verified with Node-RED and MQTT Explorer)

:check_mark: EG21-G loads certificates successfully

:multiply: Problem occurs ONLY when SSL index is linked to MQTT using AT+QMTCFG

:multiply: QMTOPEN fails if QMTCFG SSL index = 1 or 2

:check_mark: QMTOPEN succeeds only when SSL is NOT correctly linked to MQTT

:multiply: SSL handshake always fails (AWS = TLS 1.2)

2

Hi Ali,

Before anything can you help to close the MQTT connection: AT+QMTCLOSE=0.

  1. Next maybe we can debug why you cannot connect to client:
    AT+QMTCONN=0,“clientID” // your “clientID” need to as unique as possible, it cannot be general name.

  2. Why AT+QMTOPEN=0,“a2l9aypytopjpa-ats.iot.ap-south-1.amazonaws.com”,8883?
    It could be because you are not close previous QMTOPEN since your =0 is same as previous without SSL. You can close by using AT+QMTCLOSE=0 as mentioned above or use new such as 1,2,3,4,5

3

hello dear Fazrul,

Thanks for addressing, I closed the server and reopen it but the problem persists.
I think this may a firmware update issue, as the old version may not support the current ssl configuration.

4

Hi Ali,

I will contact you separately for the firmware updates.
I will send you latest packages.

Sorry for late response.

Regards,
Fazrul Redzuan