Input validation
Catches an empty host, an out-of-range port or a malformed URI before anything touches the network.
Feature
Connection Doctor
Most MQTT clients just say “connection failed.” Connection Doctor walks the connection one stage at a time and tells you exactly which step broke — with a plain-language cause and a suggested fix.
Why a connection fails, in plain language
A broker that won't connect can fail in a dozen places: DNS, the TCP socket, the TLS handshake (including the WS/WSS upgrade), the certificate, ALPN/SNI negotiation, or the MQTT protocol itself. Connection Doctor checks each one in order and stops at the first problem — so you fix the real cause instead of poking at settings.
Every result carries the technical detail and a concrete next step. Secrets, raw payloads and private hostnames never reach the log, so a result is safe to read on a shared screen or drop into a bug report.
The stages
Checked in order, stops at the first failure
DNS resolution
Resolves the broker hostname to an address and shows the resolved IPs — so a typo or a missing record is obvious.
TCP connection
Opens the socket. Distinguishes a connection refused, a timeout and an unreachable network.
TLS handshake
Opens the encrypted channel (including the WS/WSS upgrade for WebSocket brokers). Flags an unsupported TLS version, a proxy or upgrade problem, or an ALPN/SNI mismatch.
Certificate
Validates the certificate: expiry, the SAN/CN hostname and the trust chain. Flags an expired certificate or a hostname mismatch.
ALPN / SNI
Checks the negotiated protocol and server name — for example AWS IoT's x-amzn-mqtt-ca — so a wrong ALPN protocol reads in plain language.
MQTT CONNECT
Reads the CONNACK reason code, so a bad protocol version, an auth failure or a packet-size violation reads in plain language.
Connection Doctor — FAQ
What does Connection Doctor actually do?
It runs the connection one stage at a time — Input → DNS → TCP → TLS → certificate → ALPN/SNI → MQTT CONNECT → auth — and stops at the first failure, telling you which stage broke, the technical detail, and a suggested fix.
Are the diagnostics safe — do they leak secrets?
No. Passwords, certificate material, raw payloads and private endpoint hostnames never reach the diagnostic log, so a result is safe to paste into a ticket or send to a colleague.
Does it help with TLS and mTLS errors?
That's its strongest area. It names expired certificate chains, hostname mismatches, wrong ALPN protocols (for example AWS IoT's x-amzn-mqtt-ca) and unsupported TLS versions instead of a generic “handshake failed.”
Will it explain an authentication failure?
Yes. MQTT 5 reason codes from the CONNACK packet are decoded, so “not authorized” or “bad username or password” shows clearly rather than as an opaque code.
Debug your next MQTT connection in seconds
Connection Doctor ships in MQTT Commander for iPhone and iPad.
$2.99 · one-time purchase