Input validation
Catches an empty host, an out-of-range port or a malformed URI before anything touches the network.
Feature
Connection Doctor
Most MQTT clients just say “connection failed.” Connection Doctor walks the connection one stage at a time and tells you exactly which step broke — with a plain-language cause and a suggested fix.
Why a connection fails, in plain language
A broker that won't connect can fail in a dozen places: DNS, the TCP socket, the TLS handshake, a WebSocket path, the MQTT protocol itself, or the subscription. Connection Doctor checks each one in order and stops at the first problem — so you fix the real cause instead of poking at settings.
Every result includes the technical detail and a concrete next step, and you can copy a secrets-redacted diagnostic bundle to share.
The seven stages
Checked in order, stops at the first failure
DNS resolution
Resolves the broker hostname to an address and shows the resolved IPs — so a typo or a missing record is obvious.
TCP connection
Opens the socket. Distinguishes a connection refused, a timeout and an unreachable network.
TLS handshake
Verifies the certificate chain and hostname. Flags an expired chain, a hostname mismatch, an unsupported TLS version or an ALPN mismatch.
WebSocket upgrade
For WS/WSS brokers, checks the path and the HTTP upgrade, surfacing a wrong path, a bad status or a proxy problem.
MQTT protocol
Reads the CONNACK reason code, so a bad protocol version, an auth failure or a packet-size violation reads in plain language.
Subscription
Confirms your topic filter is valid and authorized — the last place a connection silently does nothing.
Connection Doctor — FAQ
What does Connection Doctor actually do?
It runs the connection one stage at a time — Input → DNS → TCP → TLS → WebSocket → MQTT → Subscription — and stops at the first failure, telling you which stage broke, the technical detail, and a suggested fix.
Can I share the diagnostic without leaking secrets?
Yes. You can copy a diagnostic bundle, and it redacts passwords, certificate material and private endpoints, so it's safe to paste into a ticket or send to a colleague.
Does it help with TLS and mTLS errors?
That's its strongest area. It names expired certificate chains, hostname mismatches, wrong ALPN protocols (for example AWS IoT's x-amzn-mqtt-ca) and unsupported TLS versions instead of a generic “handshake failed.”
Will it explain an authentication failure?
Yes. MQTT 5 reason codes from the CONNACK packet are decoded, so “not authorized” or “bad username or password” shows clearly rather than as an opaque code.
Debug your next MQTT connection in seconds
Connection Doctor ships in MQTT Commander for iPhone and iPad.
Coming soon to the App Store · $2.99