使用ESP32向AWS发送HTTPS POST请求报错400如何解决？

安全阿岳

2026-9-26

问题解决建议

首先替换普通WiFiClient为WiFiClientSecure：AWS HTTPS端点强制要求TLS加密连接，你当前用的普通WiFiClient不支持SSL/TLS，发起请求时会被服务端识别为非法请求返回400。需要引入WiFiClientSecure.h库，配置AWS根证书，测试阶段也可以临时调用client.setInsecure()跳过证书校验，生产环境必须配置正规根证书。
检查serverName配置：确保填写的是完整的HTTPS地址，和Postman测试用的地址完全一致，包括https://前缀、路径后缀、大小写以及末尾的斜杠，AWS服务对请求路径匹配规则非常严格，任意差异都会返回400。
补全缺失的请求头：你当前代码仅配置了Content-Type头，AWS大部分服务（API网关、IoT接口等）都要求额外的鉴权头，比如x-api-key、Authorization等，这些头你在Postman测试时已经配置但代码里遗漏，直接会导致400错误，请对照Postman的请求头配置补全所有必填头。
打印完整错误响应定位问题：你当前仅打印了状态码，没有获取服务端返回的错误详情，AWS返回400时会附带明确的错误说明，比如JSON格式错误、缺少参数、鉴权失败等，可以在POST请求后添加Serial.println(http.getString());打印完整返回内容，直接定位具体错误点。
校验请求Payload：确认你代码里写的JSON内容和Postman测试时的Payload完全一致，转义字符没有错误，可以把JSON内容存入变量后先打印出来对比。

核心修改代码示例

#include <WiFi.h>
#include <HTTPClient.h>
#include <WiFiClientSecure.h> // 新增SSL客户端库

const char* ssid = "你的WiFi名称";
const char* password = "你的WiFi密码";

// 填写完整的AWS HTTPS接口地址
const char* serverName = "https://xxx.execute-api.xxx.amazonaws.com/你的路径";

// Amazon Root CA 1根证书，可根据你的服务区域替换
const char* aws_root_ca = \
"-----BEGIN CERTIFICATE-----\n"
"MIIDQTCCAimgAwIBAgITBmyfz5m/jAo54vB4ikPmljZbyjANBgkqhkiG9w0BAQsF\n"
"ADA5MQswCQYDVQQGEwJVUzEPMA0GA1UEChMGQW1hem9uMRkwFwYDVQQDExBBbWF6\n"
"b24gUm9vdCBDQSAxMB4XDTE1MDUyNjAwMDAwMFoXDTM4MDExNzAwMDAwMFowOTEL\n"
"MAkGA1UEBhMCVVMxDzANBgNVBAoTBkFtYXpvbjEZMBcGA1UEAxMQQW1hem9uIFJv\n"
"b3QgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALJ4gHHKeNXj\n"
"ca9HgFB0fW7Y14h29Jlo91ghYPl0hAEvrAIthtOgQ3pOsqTQNroBvo3bSMgHFzZM\n"
"9O6II8c+6zf1tRn4SWiw3te5djgdYZ6k/oI2peVKVuRF4fn9tBb6dNqcmzU5L/qw\n"
"IFAGbHrQgLKm+a/sRxmPUDgH3KKHOVj4utWp+UhnMJbulHheb4mjUcAwhmahRWa6\n"
"VOujw5H5SNz/0egwLX0tdHA114gk957EWW67c4cX8jJGKLhD+rcdqsq08p8kDi1L\n"
"93FcXmn/6pUCyziKrlA4b9v7LWIbxcceVOF34GfID5yHI9Y/QCB/IYMGDZfrOSJQ\n"
"D40wsTQCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8w\n"
"HQYDVR0OBBYEFBiG4+NxcbPp1DNWGwuMy03Lz2k6MA4GA1UdDwEB/wQEAwIBBjAP\n"
"BgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQBcMc8FLNf43E+MfWj711Wg\n"
"wLd3+8rV3PvXWqkKdKdVq8v1n3m4N5N7N5N7N5N7N5N7N5N7N5N7N5N7N5N7N5N\n"
"-----END CERTIFICATE-----\n";

unsigned long lastTime = 0;
unsigned long timerDelay = 5000;

void setup() {
  Serial.begin(115200);
  WiFi.begin(ssid, password);
  Serial.println("Connecting");
  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }
  Serial.println("");
  Serial.print("Connected to WiFi network with IP Address: ");
  Serial.println(WiFi.localIP());
  Serial.println("Timer set to 5 seconds (timerDelay variable), it will take 5 seconds before publishing the first reading.");
}

void loop() {
  if ((millis() - lastTime) > timerDelay) {
    if (WiFi.status() == WL_CONNECTED) {
      WiFiClientSecure client;
      // 配置根证书，测试时可替换为client.setInsecure();跳过校验
      client.setCACert(aws_root_ca);
      HTTPClient http;
      http.begin(client, serverName);
      http.addHeader("Content-Type", "application/json");
      // 补全Postman里配置的其他必填头，比如API密钥
      // http.addHeader("x-api-key", "你的AWS API密钥");
      int httpResponseCode = http.POST("{\"INPUT\": \"hello world\"}");
      Serial.print("HTTP Response code: ");
      Serial.println(httpResponseCode);
      // 打印返回的错误详情
      Serial.println("Response content: ");
      Serial.println(http.getString());
      http.end();
    } else {
      Serial.println("WiFi Disconnected");
    }
    lastTime = millis();
  }
}

内容的提问来源于stack exchange，提问作者AVP123