SIM7600E-H Connection Error

HiveMQ Cloud
1

Hi

I have been trying on and off for quite some time to connect the 7600E-H to HiveMQ without success.

Tried just about everything I can think of as well as trawling the internet.

I get error 6 "6 message receive fail”

Here is the current connection attempt:

OK
AT+CNTP=“202.120.2.101”,32
OK
AT+CNTP
OK

+CNTP: 0
AT+CCLK?
+CCLK: “26/02/02,19:50:51+32”

OK
AT+CGDCONT=1,“IP”,“mob.asm.net”
OK

AT+CCERTLIST
+CCERTLIST: “isrgrootx1.pem”

OK
AT+CSSLCFG=“cacert”,0,“isrgrootx1.pem”
OK
AT+CMQTTSTART
+CMQTTSTART: 0

AT+CMQTTCONNECT=0,“tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883”,60,1,“###”,“###”
OK

+CMQTTCONNECT: 0,6

+CMQTTCONNLOST: 0,1

A little help will be VERY much appreciated.

2

Hi

FYI: Here is uploading the cert:

AT+CCERTDOWN=“isrgrootx1.pem”,1939

-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----

3

Hi @Gareth

thanks for sharing the detailed AT output, that’s very helpful.

On SIM7600, the result code

+CMQTTCONNECT: 0,6

means “message receive fail” – the module didn’t get a valid MQTT CONNACK back. That usually points to a TLS / transport issue rather than wrong MQTT username/password.

You’re already using the correct CA (isrgrootx1.pem, ISRG Root X1 from Let’s Encrypt), so the remaining pieces are the TLS profile (including SNI) and binding that profile to the MQTT client.

Below is a configuration that is known to work with SIM7600 and HiveMQ Cloud. You can adapt it to your APN and your own cluster/credentials.

1. Make sure the CA is installed correctly

You already did this, but for completeness:

AT+CCERTLIST

You should see:

+CCERTLIST: isrgrootx1.pem

Optionally, you can verify the size:

AT+FSCD="C:\"
AT+FSCD="/mssl_cert/"
AT+FSATTRI="isrgrootx1.pem"

The file size should be 1939 bytes, which matches the standard ISRG Root X1 PEM from Let’s Encrypt (https://letsencrypt.org/certs/isrgrootx1.pem).

2. Configure the TLS context (session 0)

Run these once after network context is up:

// Pick TLS 1.2
AT+CSSLCFG="sslversion",0,4

// Verify server certificate only (CA-based auth)
AT+CSSLCFG="authmode",0,3

// Ignore local time (helps if RTC/NTP is slightly off)
AT+CSSLCFG="ignorelocaltime",0,1

// Use the ISRG Root X1 CA you uploaded
AT+CSSLCFG="cacert",0,"isrgrootx1.pem"

// Allow all cipher suites (let server negotiate)
AT+CSSLCFG="ciphersuites",0,0xFFFF

// IMPORTANT: enable SNI for HiveMQ Cloud
AT+CSSLCFG="enableSNI",0,1

// Check the full TLS config
AT+CSSLCFG?

SNI is required for HiveMQ Cloud, and without enableSNI the TLS handshake often fails without a clear error, which then shows up as +CMQTTCONNECT: 0,6.

3. Start MQTT and bind SSL to the MQTT client

After PDP context and AT+NETOPEN succeed:

// Start MQTT stack
AT+CMQTTSTART

// Create MQTT client 0 with a client ID (QoS 1, clean session)
AT+CMQTTACCQ=0,"sim7600_client",1,4

// Bind MQTT client 0 to TLS session 0 configured above
AT+CMQTTSSLCFG=0,0

// Now connect to HiveMQ Cloud over TLS
AT+CMQTTCONNECT=0,"tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883",60,1,"YOUR_USERNAME","YOUR_PASSWORD"

Replace YOUR_USERNAME and YOUR_PASSWORD with the access credentials you created in the HiveMQ Cloud UI.

If everything is correct, you should see:

OK
+CMQTTCONNECT: 0,0

instead of 0,6.

4. Sanity check the credentials (optional but recommended)

From a PC, you can verify hostname/port/credentials independently using an MQTT client, for example mqtt-cli:

mqtt sub -h 140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud -p 8883 -s -u YOUR_USERNAME -pw -t 'test/topic'

If that works, your hostname, port, and credentials are definitely fine, and any remaining problem is purely on the SIM7600 side (TLS/SNI or APN/network).

Best regards,
Dasha from the HiveMQ Team

4

Hi

Thank you so much for this, but it still does not work.

I get error 33 (not set certificate)

AT+CMQTTCONNECT=0,“tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883”,60,1,“xxxx”,“xxxx”
OK

+CMQTTCONNECT: 0,33
AT+CSSLCFG?
+CSSLCFG: 0,4,3,1,300,“isrgrootx1.pem”,“”,“”,1,“”,0xFFFF
+CSSLCFG: 1,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 2,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 3,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 4,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 5,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 6,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 7,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 8,4,0,1,300,“”,“”,“”,0,“”,0xFFFF
+CSSLCFG: 9,4,0,1,300,“”,“”,“”,0,“”,0xFFFF

I’ve tried:

AT+CMQTTSSLCFG=0,0
OK
AT+CMQTTCONNECT=0,“tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883”,60,1,“xxxx”,“xxxx”
OK

+CMQTTCONNECT: 0,33
AT+CMQTTSSLCFG=0,1
OK
AT+CMQTTCONNECT=0,“tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883”,60,1,“xxxx”,“xxxx”
OK

+CMQTTCONNECT: 0,31
AT+CMQTTCONNECT=0,“tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883”,60,1,“xxxxx”,“xxxxxx”
OK

I’m giving up hope here….

It works with Mosquito, but this dev project is for a large(ish) scale deployment and I do not want to host a server etc, I REALLY want to use HiveMQ but don’t know what to do next.

Any further help would really be appreciated.

5

Hello @Gareth

thank you for sharing the detailed AT command logs.

From the output, we can see that your modem’s SSL context 0 is configured with:

  • A CA certificate: isrgrootx1.pem Download it form here
  • authmode = 3 (verify server and client certificate)
  • No client certificate and no client key configured

In this configuration, the module expects a client certificate/key pair for mutual TLS. Since no client certificate is set, the modem reports +CMQTTCONNECT: 0,33 (“not set certificate”).

HiveMQ Cloud only requires:

  • TLS with the correct CA (Let’s Encrypt ISRG Root X1)
  • Username and password authentication

A client certificate is not needed, so we recommend switching to server‑only authentication on the modem.

Please try the following sequence (after ensuring isrgrootx1.pem is already on the module):

  1. Configure TLS context 0 (run once, or after a reset)
AT+CMEE=2

AT+CSSLCFG="sslversion",0,3
AT+CSSLCFG="authmode",0,1
AT+CSSLCFG="cacert",0,"isrgrootx1.pem"

-- Optional but recommended, if supported by your firmware:
AT+CSSLCFG="sni",0,"140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud"
-- or
AT+CSSLCFG="enableSNI",0,1

You can verify the SSL context with:

AT+CSSLCFG?

Context 0 should now show authmode = 1 and cacert = "isrgrootx1.pem".

  1. MQTT connection sequence to HiveMQ Cloud
AT+CMQTTSTART
AT+CMQTTACCQ=0,"client-id",1
AT+CMQTTSSLCFG=0,0
AT+CMQTTCONNECT=0,"tcp://140a405c2f3e4427aa4b1e83ea4d84d9.s1.eu.hivemq.cloud:8883",60,1,"username","password"

Where:

  • client-id is any unique MQTT client ID.
  • cloud-username and cloud-password are the credentials from Access Management in your HiveMQ Cloud cluster.

If you still see a different CMQTTCONNECT error code after this change, please send us the updated AT log (including AT+CSSLCFG? and AT+CCLK?)

Best regards,
Sheetal from HiveMQ Team