diff --git a/fhem/FHEM/00_MQTT2_CLIENT.pm b/fhem/FHEM/00_MQTT2_CLIENT.pm
index c519ac3ec..b6ea18155 100644
--- a/fhem/FHEM/00_MQTT2_CLIENT.pm
+++ b/fhem/FHEM/00_MQTT2_CLIENT.pm
@@ -40,6 +40,7 @@ MQTT2_CLIENT_Initialize($)
     clientId
     clientOrder
     connectTimeout
+    connectFn
     disable:1,0
     disabledForIntervals
     disconnectAfter
@@ -97,7 +98,17 @@ MQTT2_CLIENT_Define($$)
   $hash->{connecting} = 1;
   $hash->{nrConnects} = 0;
 
-  InternalTimer(1, "MQTT2_CLIENT_connect", $hash, 0); # need attributes
+  InternalTimer(1, sub($){
+    my $cfn = AttrVal($hash->{NAME}, "connectFn", undef);
+    if($cfn) {
+      my %specials= ("%NAME" => $hash->{NAME});
+      $cfn = EvalSpecials($cfn, %specials);
+      AnalyzeCommand(undef, $cfn); # $cfn calls connect 
+    } else {
+      MQTT2_CLIENT_connect($hash);
+    }
+  }, $hash, 0);
+
   return undef;
 }
 
@@ -136,6 +147,8 @@ MQTT2_CLIENT_doinit($)
   if($hash->{connecting} == 1) {
     my $usr = AttrVal($name, "username", "");
     my ($err, $pwd) = getKeyValue($name);
+    $usr = $hash->{".usr"} if($hash->{".usr"}); # AWS/WORX
+    $pwd = $hash->{".pwd"} if($hash->{".pwd"});
     $pwd = undef if($usr eq "");
     if($err) {
       Log 1, "ERROR: $err";
@@ -876,6 +889,14 @@ MQTT2_CLIENT_feedTheList($$$)
       Note: Changing the attribute affects _all_ MQTT2_CLIENT instances.
       </li></br>
 
+    <a id="MQTT2_CLIENT-attr-connectFn"></a>
+    <li>connectFn {...}<br>
+      if set, do not connect immediately, but evaluate the argument, which in
+      turn has to call the connect function via fhem("set NAME connect") or
+      MQTT2_CLIENT_connect(...).<br>
+      Needed by AWS-IOT connect with custom auth.
+      </li></br>
+
     <a id="MQTT2_CLIENT-attr-connectTimeout"></a>
     <li>connectTimeout &lt;seconds&gt;<br>
       change the HTTP connect timeout, default is 4 seconds. This seems to be
diff --git a/fhem/FHEM/HttpUtils.pm b/fhem/FHEM/HttpUtils.pm
index 853112058..ebe85cf78 100644
--- a/fhem/FHEM/HttpUtils.pm
+++ b/fhem/FHEM/HttpUtils.pm
@@ -557,6 +557,14 @@ HttpUtils_Connect2NonblockingSSL($$)
     }
 
     $hash->{hu_sslAdded} = $hash->{keepalive} ? 1 : 2;
+
+    Log 4, "alpn_selected:".$hash->{conn}->alpn_selected()
+      if($par->{SSL_alpn_protocols} &&
+         $hash->{conn}->can('alpn_selected'));
+    Log 4, "next_proto_negotiated:".$hash->{conn}->next_proto_negotiated()
+      if($par->{SSL_npn_protocols} &&
+         $hash->{conn}->can('next_proto_negotiated'));
+
     return HttpUtils_Connect2($hash); # Continue with HTML-Processing
   };