Troubleshoot a device connection

Check these items in order. Do not disable certificate verification to make a test pass.

Symptom

Likely cause

Action

DNS or TCP timeout

device network cannot reach the public device edge

verify DNS and outbound TCP 443/8883

TLS hostname error

wrong endpoint or stale trust anchors

configure the origin for the account’s region; install the approved CA bundle

MQTT refused as not authorized

the device is connecting to the other region’s origin

re-provision against the origin for the account’s region; this refusal is terminal, so stop retrying

Provisioning reports an origin mismatch

the device already records a different origin

leave the recorded origin as it is; move a device between regions only by an explicit re-provision

HTTPS 401 during first boot

bootstrap credential is missing

restore the factory-issued credential; never substitute a user token

HTTPS 403 not recognized

model or serial is not registered

ask the registrar/factory owner to correct the model registration

HTTPS 403 blacklisted

device identity is terminally blocked

stop retries and escalate to the fleet owner

HTTPS 429

the device is retrying too aggressively

honor Retry-After and use exponential backoff with jitter

HTTPS 503

a required backend or verified edge cache is unavailable

retry with bounded backoff; preserve the response correlation data

MQTT TLS succeeds, then disconnects

certificate identity and topic identity differ, or a topic is not allowed

use the thing_id returned by provisioning; inspect the broker reason code

OTA returns 401/403

missing, invalid, revoked, or stale device certificate

verify the stored device certificate and its validity period

OTA has no deployment

no matching active assignment exists

check the artifact and rollout in Dev2M/OTAForge; do not bypass DDI

When escalating, provide the timestamp in UTC, device model, serial number, thing_id if known, the origin the device is provisioned against, HTTP status or MQTT reason code, and a request correlation identifier. Never attach private keys, bootstrap credentials, enrollment tokens, or full authorization headers.