Secure ADB connection fails with `[SSL: UNEXPECTED_EOF_WHILE_READING]`: reconfigure CLI with valid API key and correct tenant name

Android

When a Secure ADB connection attempt fails with [SSL: UNEXPECTED_EOF_WHILE_READING], the CLI cannot complete the TLS handshake with Esper's relay service and the session is dropped immediately.

Why this happens

The SSL error occurs when the CLI authenticates with an expired or invalid API key, uses an incorrect tenant name in its configuration, or attempts to connect to a device that does not have ADB access enabled. Any of these conditions causes the relay service to close the connection before a secure session can be established.

Before you begin

Enterprise Admin access to the Esper Console
Esper CLI installed on your machine
The device serial number or name you want to connect to

Steps

Enable ADB access on the device. In the Esper Console, go to Devices & Groups → [Device Name] → Settings and confirm that ADB access is enabled. ADB must be explicitly enabled per device before a Secure ADB session can be established — the relay service rejects connections for devices where it is off.
Generate a new API key. In the Esper Console, navigate to API Key Management and generate a new key. Copy it immediately — the Console will not display it again after you leave the page.
Reconfigure the Esper CLI with the new key. Open a terminal and run:
```
espercli configure
```
At the prompts, enter:
- Environment name: your tenant name only (for example, acme, not the full URL)
- Esper API Key: the key you copied in the previous step
Using the full URL instead of the short tenant name is a common cause of this error — the CLI derives the endpoint from the tenant name itself.
Connect to the device. Run the following command, replacing <DEVICE_NAME> with your device's name or serial number:
```
espercli secureadb connect -d <DEVICE_NAME>
```
A successful session prints a local port binding, for example:
```
Secure ADB session established on 127.0.0.1:12345
```
Verify the ADB connection by connecting to the local port printed in the previous step:
```
adb connect 127.0.0.1:<port>
```

Verify: The adb connect command should return connected to 127.0.0.1:<port> and you should have an active ADB shell session to the device. If the session drops or the SSL error recurs, continue to the troubleshooting steps below.

If this doesn't resolve it

Try these additional checks before contacting support:

Check outbound network access. Confirm that outbound TCP traffic to *.esper.cloud on ports 40000–50000 is permitted by your firewall or network policy. The relay service uses this port range for Secure ADB tunnels.
Verify the API key privilege level. Confirm the key was generated from an Enterprise Admin account. Keys from lower-privilege accounts can fail silently at the session layer without a clear error.

Run in debug mode to capture detailed output:

espercli -D secureadb connect -d <DEVICE_NAME>

If the error persists after all of the above, contact Esper Support and include:

The full debug output from espercli -D secureadb connect -d <DEVICE_NAME>
Your CLI version (run espercli --version)
Your device serial number or ID
Confirmation that ADB is enabled in the Esper Console for the device

Still need help?

If you're still encountering SSL connection errors after verifying your API key and tenant name, please submit a support ticket and include your CLI version, the exact error message, and confirmation of your correct tenant name and API key configuration.