CONNACK 2 (0x02) — Connection Refused: identifier rejected

The client id is malformed or not permitted. The broker understood the connection attempt and specifically refused the identifier.

Start free MQTT / Sparkplug B → canonical

Diagnosis

When you hit this

A client id longer than 23 characters against a broker enforcing the 3.1 limit strictly.
Non-UTF-8 or otherwise illegal characters in an id built from a hostname or serial number.
An empty client id combined with clean session false, which the specification forbids.
Two devices sharing one id, so each connection evicts the other — this looks like flapping rather than a clean refusal.

Resolution

How to fix it

Make ids unique and boring
Alphanumerics and hyphens, under 23 characters. Derive from a stable device identifier, not from a random value that changes each boot.
Look for a duplicate before blaming the format
If two clients share an id, both will appear to connect and drop repeatedly. Broker logs show both connections.
Never use empty id with a persistent session
An empty id requires clean session true. The combination with false is a protocol error.

Normalization

What Forge does about it

This is a configuration or addressing mistake on the wire, upstream of anything Forge sees. Where Forge helps is the step after you fix it: once the point returns data, its vendor tag name maps to a canonical field automatically, so you do not also have to hand-maintain a name table for every point you just re-addressed.