Secure Remote ADB connection fails with "Failed to establish Secure ADB connection" — stuck at certificate exchange phase

Android

When attempting a Secure ADB session using the Esper CLI, the connection stalls and returns Failed to establish Secure ADB connection before a usable port is assigned.

Why this happens

Secure ADB routes through Esper's relay service and requires a certificate exchange between your machine and the enrolled device. This handshake fails when the CLI is given the wrong device identifier, when firewall or proxy rules block the relay ports, or when a stale API key prevents the CLI from authenticating to the relay service.

Before you begin

Confirm all three of the following are true before working through the steps:

The Esper CLI is installed and configured on your machine.
The target device is enrolled in Esper and shows a status of Active.
Remote ADB is enabled on the device (verified in step 2 below).

Steps

Find the device UUID. The secureadb connect command requires the device's UUID, not its display name or alias. Run the following command, substituting the device's alias:
```
espercli device list -n <device-alias>
```
Copy the value shown in the ID column. This is the UUID you will use in every subsequent step.
Confirm Remote ADB is enabled in the Esper Console. Navigate to Devices & Groups → [Device Name] → Settings and verify the Remote ADB toggle is on. The toggle must be active at the time of connection — toggling it off clears the relay registration.
Attempt the connection using the device UUID. Run:
```
espercli secureadb connect -d <device-uuid>
```
A successful connection prints an adb connect command containing a locally forwarded port (for example, adb connect 127.0.0.1:62000). Run that command and confirm the device appears in:
```
adb devices
```
If the connection succeeds, stop here. If it stalls, continue to step 4.
Enable debug logging to identify where the handshake stalls. Run:
```
espercli -D secureadb connect -d <device-uuid>
```
Review the output and note the last line printed before the command hangs or exits. Output that stops at Acquiring Device's Certificate… confirms the failure is in the certificate exchange phase and is almost always caused by a firewall or proxy blocking the relay ports.
Check firewall rules for the relay service ports. Your machine and the device's network must both allow outbound TCP traffic on ports 40000–50000 to the following destinations:
- remoteaccess.esper.cloud
- 13.52.132.230
If your environment uses a corporate proxy or VPN that performs TLS inspection, configure it to pass traffic to remoteaccess.esper.cloud through without inspection. TLS interception breaks the certificate exchange regardless of whether the ports are open. For full firewall requirements, see the Firewall Requirements documentation.
Regenerate your API key if firewall rules are confirmed open. A stale or corrupted API key can cause the CLI to fail authentication with the relay service even when network access is unrestricted. In the Esper Console, navigate to API Key Management, generate a new key, then reconfigure the CLI:
```
espercli configure -s
```
Retry the secureadb connect command after reconfiguring.
Verify the Esper Agent version on the device. Navigate to Devices & Groups → [Device Name] → Device Info and check the agent version. Devices that were recently offline or re-enrolled may be running an agent that has not yet registered its certificate with the relay service. Restart the device and allow 5 minutes for registration to complete, then retry the connection. If the agent is outdated, apply the latest version via Esper Software Updates before retrying.

Verify: A successful connection prints a local forwarded port address and the device appears as online in adb devices within 30 seconds of running the adb connect command.

If this doesn't resolve it

If the connection still fails after completing all steps, contact Esper Support and include the following:

The full debug log output from espercli -D secureadb connect -d <device-uuid>
The device UUID and its current status in the Esper Console
Confirmation of which firewall ports are open and whether a proxy or VPN is in use
The Esper Agent version shown in Devices & Groups → [Device Name] → Device Info

Still need help?

If the steps above don't resolve the issue, submit a support ticket with your device model, Android version, Esper Agent version, and a description of what you've already tried — this helps the support team investigate without a follow-up.