Amazon Q CLI "Amazon Q is having trouble responding right now" with Dispatch Failure - intermittent issue

This error appears to be related to connectivity issues between your Amazon Q CLI client and the AWS service endpoints. The "dispatch failure" and "io error" messages indicate problems establishing or maintaining the network connection required for Amazon Q to function properly.

Based on the intermittent nature of the issue, here are some potential causes and troubleshooting steps:

1. Network connectivity issues: Amazon Q uses WebSocket technology over specific ports to maintain secure communication with its endpoints. When using a mobile hotspot, you might experience intermittent connectivity issues that affect these connections.

2. General troubleshooting steps:

• Verify your internet connection is stable
• Ensure you're properly authenticated with valid credentials
• Try running q doctor in your terminal to diagnose common issues with your Amazon Q installation
• Break down your prompts into smaller, less complex inputs

3. Service capacity issues: The AWS team is aware of some users experiencing errors due to high demand following recent launches. This could be temporarily affecting Amazon Q CLI and other Q-powered tools as they share the same backend infrastructure.

4. Reporting the issue: If the problem persists after trying the above steps, you can report the issue using the q issue command in your terminal. This will help the AWS team track and address the problem.

Since you're experiencing this issue with both Q CLI and Kiro CLI, and it happens intermittently without any configuration changes, it does suggest a potential service-side issue rather than a local configuration problem. The AWS team may be working on stabilizing the service and provisioning additional capacity to address these types of issues.
Sources
Amazon Q is having trouble responding right now: | AWS re:Post
Troubleshoot server stopped responding error in Amazon Q Business | AWS re:Post
Troubleshoot Amazon Q Developer - Amazon Q Developer

I experienced the same issue and was able to resolve it. In particular I experienced it using WSL2 Ubuntu. The root cause was the use of Zscaler on my company's workstations. Zscaler uses man-in-the-middle certificates for their "private access" capability. You can verify if your issue has the same root cause by curling the amazon q endpoint:

$ curl -vk https://q.us-east-1.amazonaws.com/
* Host q.us-east-1.amazonaws.com:443 was resolved.
* IPv6: (none)
* IPv4: 52.204.207.171, 3.209.234.169, 54.144.191.233
*   Trying 52.204.207.171:443...
* Connected to q.us-east-1.amazonaws.com (52.204.207.171) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / prime256v1 / RSASSA-PSS
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*  subject: CN=q.us-east-1.amazonaws.com; O=Zscaler Inc.; OU=Zscaler Inc.
*  start date: Nov 25 12:43:46 2025 GMT
*  expire date: Dec  6 05:13:00 2025 GMT
*  issuer: C=US; ST=California; O=Zscaler Inc.; OU=Zscaler Inc.; CN=Zscaler Intermediate Root CA (zscaler.net) (t)
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
*   Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption

Note the SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.

What I ended up doing was copying the Zscaler root certificates from Windows to WSL2 Ubuntu.

Export the Zscaler Root Certificate from Windows:

• Open the Windows Certificate Manager (certlm.msc).
• Navigate to "Trusted Root Certification Authorities" > "Certificates".
• Locate the Zscaler Root CA certificate (its name may vary slightly, but it will typically contain "Zscaler").
• Right-click the certificate, select "All Tasks" > "Export...".
• Follow the Certificate Export Wizard, choosing "DER encoded binary X.509 (.CER)" or "Base-64 encoded X.509 (.CER)" format. Save the certificate to a location accessible from WSL2 (e.g., your Windows Downloads folder).

Copy and Convert the Certificate in WSL2:

• Open your WSL2 terminal.
• Navigate to the directory where you saved the certificate (e.g., /mnt/c/Users/<YourUsername>/Downloads/).
• If you exported in DER format, convert it to PEM format using openssl:

   openssl x509 -inform DER -in zscaler_root_ca.cer -out zscaler_root_ca.crt
  

• Copy the converted .crt file to the /usr/local/share/ca-certificates/ directory:

  sudo cp zscaler_root_ca.crt /usr/local/share/ca-certificates/
  

• Update the CA certificate database.

  sudo update-ca-certificates
  

After this, certificates passed validation, and Amazon Q worked as normal again.