SSL/TLS Handshake Issue with SIM7022 Modem Connecting to AWS IoT Core via MQTT

Question

**Issue Description**

I'm facing an SSL/TLS handshake failure when trying to connect my IoT device, equipped with a SIM7022 cellular modem, to AWS IoT Core using MQTT. I've configured the SSL settings with the following AT command to enable Server Name Indication (SNI):

AT+CSSLCFG="enableSNI",0,1

Despite this and other configurations, the handshake fails, and I’m unable to establish a secure MQTT connection. The modem responds with an error (specific error code unavailable, but typically ERROR or a connection failure during AT+CMQTTSTART or AT+CMQTTCONNECT).

**Setup Details**
Device: SIM7022
Firmware Version: 2110B07SIM7022
AWS Service: AWS IoT Core
Protocol: MQTT
TLS Version: TLS 1.2
Certificates: Using AWS IoT certificates (device certificate, private key, and Amazon Root CA 1) downloaded from the AWS IoT Console
Connection String/Configuration: MQTT client ID configured via AT+CMQTTCLIENTID, endpoint set via AT+CMQTTTOPIC or similar commands
Steps Taken to Troubleshoot

**I’ve checked the following to resolve the SSL/TLS handshake issue:**

Certificates: Verified that the device certificate, private key, and Amazon Root CA 1 are correctly loaded onto the modem using AT commands (e.g., AT+CSSLCFG="cacert",0,...).

SNI: Enabled SNI using AT+CSSLCFG="enableSNI",0,1 to ensure the hostname is included in the TLS handshake.

System Time: Ensured the device’s date and time are correct (synced via NTP or manually set) to avoid certificate validation issues.

TLS Version: Assumed TLS 1.2 is used, as required by AWS IoT Core. [Note: I haven’t explicitly set the TLS version; SIM7022 documentation suggests it defaults to TLS 1.2.]

Cipher Suites: Not explicitly configured, relying on the modem’s default cipher suites. [Unsure if SIM7022 supports AWS-compatible ciphers like TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.]

Network: Confirmed network connectivity with AT+CPIN?, AT+CGATT?, and AT+CSQ, ensuring the modem is registered and has a strong signal.

Logs/Debug Info: [Limited logs available; please include any specific error messages, e.g., CME ERROR:  or MQTT-specific errors, if known.]

**Despite these efforts, the handshake still fails. Possible causes I suspect:**

A mismatch in TLS versions or cipher suites between the SIM7022 and AWS IoT Core.

An issue with the AWS endpoint’s certificate or hostname configuration.

A firmware limitation in the SIM7022 (2110B07SIM7022) or a missing AT command for proper SSL configuration.

**Questions**

Has anyone successfully connected a SIM7022 modem (firmware 2110B07SIM7022) to AWS IoT Core using MQTT? If so, what AT commands or configurations were used?

Are there specific AT commands for the SIM7022 to set TLS version, cipher suites, or debug SSL handshake issues?

Could this be related to AWS IoT Core’s certificate requirements or endpoint configuration?

Any recommendations for debugging the handshake further (e.g., specific SIM7022 AT commands for logs or external tools like Wireshark)?

re:Post Agent · Answer

Based on the information provided, it appears you're experiencing a common SSL/TLS handshake issue when connecting your SIM7022 modem to AWS IoT Core via MQTT. Here are some insights and recommendations to help resolve the issue:

1. Certificate Chain Verification:
Ensure that your device has the complete certificate chain for server authentication. AWS IoT Core presents a certificate chain that devices use to verify they're communicating with AWS IoT Core. Make sure you have installed the Amazon Root CA 1 certificate, and potentially the Amazon Root CA 2, 3, and 4 certificates in your device's trust store.

2. Server Name Indication (SNI):
You've correctly enabled SNI, which is crucial. SNI is required for features like multi-account registration, configurable endpoints, and custom domains. Ensure that the hostname is correctly set in your MQTT connection parameters.

3. TLS Version:
AWS IoT Core uses TLS version 1.2 and 1.3. While you assume TLS 1.2 is being used, it's worth explicitly setting this if possible. Check if there's an AT command to set the TLS version for your SIM7022 modem.

4. Cipher Suites:
AWS IoT Core supports specific cipher suites. Ensure your modem supports and is configured to use a compatible cipher suite, such as TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256. Check if there's an AT command to list or set supported cipher suites.

5. Certificate Expiration:
Verify that your device certificate and CA certificates are not expired. CA certificates have expiration dates and should be updated regularly.

6. ALPN Protocol:
For X.509 client certificate authentication on port 443, Application Layer Protocol Negotiation (ALPN) is required. Check if your modem supports ALPN and if it's correctly configured.

7. Policy Permissions:
Ensure that the policy attached to your device certificate allows the necessary actions for connecting to AWS IoT Core.

8. Debugging:
Look for AT commands that can provide more detailed SSL/TLS handshake logs. External tools like a protocol analyzer (e.g., Wireshark) can be invaluable for debugging the handshake process if you can capture the network traffic.

9. Firmware Update:
Consider checking for any firmware updates for your SIM7022 modem that might address SSL/TLS connectivity issues.

10. AWS IoT Core Endpoint:
Double-check that you're using the correct AWS IoT Core endpoint for your account and region.

If the issue persists after verifying these points, you may need to contact the modem manufacturer for specific guidance on SSL/TLS configuration for AWS IoT Core connectivity. They might have additional AT commands or configuration options that can help resolve the handshake failure.

Remember, successful TLS handshake and connection to AWS IoT Core requires proper configuration of both the client (your device) and the server (AWS IoT Core), so ensuring all aspects are correctly set up is crucial for establishing a secure MQTT connection.
      
**Sources**  
[Server authentication - AWS IoT Core](https://docs.aws.amazon.com/iot/latest/developerguide/server-authentication.html)  
[Device communication protocols - AWS IoT Core](https://docs.aws.amazon.com/iot/latest/developerguide/protocols.html)  
[Set up and troubleshoot AWS IoT Greengrass with client devices - AWS Prescriptive Guidance](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/set-up-and-troubleshoot-aws-iot-greengrass-with-client-devices.html)

SSL/TLS Handshake Issue with SIM7022 Modem Connecting to AWS IoT Core via MQTT

Add your answer

Relevant content