Troubleshooting · Troubleshooting
Device can't connect
Every refusal reason, what it means and how to fix it.
Updated 11 Nov 20262 min read
All ThingsX IoT Core pages
- What ThingsX IoT Core does
- Quick start: connect your first device
- Key concepts
- Security and access
- Connect Wi-Fi and IoT devices
- BLE gateways, shelf labels and child devices
- LoRaWAN sensors and gateways
- Industrial I/O modules
- Device twins and state
- Send commands to devices
- Rules: react to device messages
- SDK and REST API
- Monitor your fleet and support customers
- Moving from another IoT platform
- From AWS IoT Core
- From Azure IoT Hub and other platforms
- Device can't connect
- Devices keep disconnecting or reconnecting
- Data isn't arriving or a rule doesn't fire
- Frequently asked questions
- Topics and limits reference
Start with the device's Diagnose tab: it runs every check and shows the last refusal with its reason. The Event log filtered by the device's client ID shows each attempt.
Refusal reasons
| Reason | What it means | Fix |
|---|---|---|
CERT_UNKNOWN | The certificate the device presented isn't registered | Register it (Certificates → Register an existing certificate) or download the one IoT Core issued for this device |
CERT_INACTIVE | The certificate is registered but set to inactive | Activate it, or attach a new active certificate |
CERT_REVOKED | The certificate was revoked | Issue a new certificate for the device; revoked ones can't be reactivated |
CERT_EXPIRED | The certificate's validity has ended | Issue a new certificate and install it. Rotate before expiry: the Overview warns 30 days ahead |
BAD_CREDENTIALS | Wrong username or password | Check the credential on the Passwords page; reset it and update the device |
NO_IDENTITY | Neither a client certificate nor a username was sent | Configure the device's TLS client certificate, or a username and password |
CONNECT_IMPLICIT_DENY | The device proved who it is, but no policy allows it to connect with this client ID | Make the client ID equal the thing name, and check the policy with the simulator |
No refusal in the log at all
If nothing appears, the device never reached IoT Core:
- DNS or network: can the device resolve and reach
<your-endpoint>on port 8883 (or 8443)? Store and factory firewalls often block outbound 8883; use 8443 (WebSocket) or ask IT to allow it. - TLS handshake fails: the device doesn't trust the server certificate. Install the workspace root CA. Also check the device clock: a clock in 1970 makes every certificate look invalid.
- Wrong port for the method: certificates on 8883; passwords on 8883, 8443 or (private networks only) 1883.
Was this page helpful?
Can't find what you need? Contact support or read about ThingsX IoT Core.