I've been trying to configure AWS IoT to communicate over MQTT using TLS for days on a D1 Mini board and have been running into a road block with authentication.

I've used several AWS IoT Arduino libraries such as this one that hardcodes or uses SPIFFS to store the keys, but they don't seem to be the issue. One solution suggested increasing the timeout in the PubSubClient library, but it doesn't seem to be timing out. They all result in the same wifi debug output, indicating there was a certificate exchange and after exchanging certificates, AWS closes the connection.

Here is the raw output of the ESP debugger.

I've tried many solutions such as creating a certificate through AWS and creating my own certificate following this guide. My certificates also have policies to allow full access to AWS IoT.

I appear to connect in the picture below, but it doesn't seem to be consistent. enter image description here

At this point I'm going to try a few more arduino libraries or switch services. Any recommendations would be greatly appreciated. Thank you for your time.

  • From the ESP debugger output you posted, Error: maximum number of certs added (1) - change of compile-time configuration required looks like a problem. Any reason you are not addressing the issue? – jww Oct 14 at 3:55
  • From the ESP debugger output you posted, the hostname .iot.us-west-2.amazonaws.com looks malformed to me. Maybe ESP is doing some funky formatting. – jww Oct 14 at 3:56
  • From the ESP debugger output you posted, Common Names (CN) like *.iot.us-west-2.amazonaws.com are clearly wrong. It violates the latest CA/Browser Baseline Requirements. Conforming user agents should (could?) reject the certificate as malformed. – jww Oct 14 at 3:58

I managed to resolve the connection issues by removing the comments for the CA in the library I linked and uploading the Amazon root certificate to the board as a .der file as I showed in here

New contributor
Thibaut Hardin is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.