diff --git a/cabal.project b/cabal.project
index b7baee588..642f3d102 100644
--- a/cabal.project
+++ b/cabal.project
@@ -9,7 +9,7 @@ constraints: zip +disable-bzip2 +disable-zstd
 source-repository-package
     type: git
     location: https://github.com/simplex-chat/simplexmq.git
-    tag: 3b348a463cd83fbd803743b1d67f282a42d8b654
+    tag: c501f4f9ccdd48807a5153697ea1827129841158
 
 source-repository-package
     type: git
diff --git a/scripts/nix/sha256map.nix b/scripts/nix/sha256map.nix
index 5f6574288..c211fc99e 100644
--- a/scripts/nix/sha256map.nix
+++ b/scripts/nix/sha256map.nix
@@ -1,5 +1,5 @@
 {
-  "https://github.com/simplex-chat/simplexmq.git"."3b348a463cd83fbd803743b1d67f282a42d8b654" = "1rbd5zz1rclnfvjf68ll5qhi9yqk040bi491z10hwyhxi2bixpaw";
+  "https://github.com/simplex-chat/simplexmq.git"."c501f4f9ccdd48807a5153697ea1827129841158" = "1s99mjc7rjk9wg14m5xddw64a3mlr8l7ba9mclma598hg73l0vaw";
   "https://github.com/simplex-chat/hs-socks.git"."a30cc7a79a08d8108316094f8f2f82a0c5e1ac51" = "0yasvnr7g91k76mjkamvzab2kvlb1g5pspjyjn2fr6v83swjhj38";
   "https://github.com/kazu-yamamoto/http2.git"."f5525b755ff2418e6e6ecc69e877363b0d0bcaeb" = "0fyx0047gvhm99ilp212mmz37j84cwrfnpmssib5dw363fyb88b6";
   "https://github.com/simplex-chat/direct-sqlcipher.git"."f814ee68b16a9447fbb467ccc8f29bdd3546bfd9" = "1ql13f4kfwkbaq7nygkxgw84213i0zm7c1a8hwvramayxl38dq5d";
diff --git a/stack.yaml b/stack.yaml
index 4ef1c422e..f3d98d7f6 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -49,7 +49,7 @@ extra-deps:
   # - simplexmq-1.0.0@sha256:34b2004728ae396e3ae449cd090ba7410781e2b3cefc59259915f4ca5daa9ea8,8561
   # - ../simplexmq
   - github: simplex-chat/simplexmq
-    commit: 3b348a463cd83fbd803743b1d67f282a42d8b654
+    commit: c501f4f9ccdd48807a5153697ea1827129841158
   - github: kazu-yamamoto/http2
     commit: f5525b755ff2418e6e6ecc69e877363b0d0bcaeb
   # - ../direct-sqlcipher
diff --git a/tests/RemoteTests.hs b/tests/RemoteTests.hs
index 0d3dc7462..db19cac51 100644
--- a/tests/RemoteTests.hs
+++ b/tests/RemoteTests.hs
@@ -36,6 +36,7 @@ remoteTests = describe "Remote" $ do
     it "connects with new pairing (stops mobile)" $ remoteHandshakeTest False
     it "connects with new pairing (stops desktop)" $ remoteHandshakeTest True
     it "connects with stored pairing" remoteHandshakeStoredTest
+    it "refuses invalid client cert" remoteHandshakeRejectTest
   it "sends messages" remoteMessageTest
   describe "remote files" $ do
     it "store/get/send/receive files" remoteStoreFileTest
@@ -95,6 +96,36 @@ remoteHandshakeStoredTest = testChat2 aliceProfile aliceDesktopProfile $ \mobile
   startRemoteStored mobile desktop
   stopMobile mobile desktop `catchAny` (logError . tshow)
 
+remoteHandshakeRejectTest :: HasCallStack => FilePath -> IO ()
+remoteHandshakeRejectTest = testChat3 aliceProfile aliceDesktopProfile bobProfile $ \mobile desktop mobileBob -> do
+  logNote "Starting new session"
+  startRemote mobile desktop
+  stopMobile mobile desktop
+
+  mobileBob ##> "/set device name MobileBob"
+  mobileBob <## "ok"
+  desktop ##> "/start remote host 1"
+  desktop <## "remote host 1 started"
+  desktop <## "Remote session invitation:"
+  inv <- getTermLine desktop
+  mobileBob ##> ("/connect remote ctrl " <> inv)
+  mobileBob <## "connecting new remote controller: My desktop, v5.4.0.3"
+  mobileBob <## "remote controller stopped"
+
+  -- the server remains active after rejecting invalid client
+  mobile ##> ("/connect remote ctrl " <> inv)
+  mobile <## "connecting remote controller 1: My desktop, v5.4.0.3"
+  desktop <## "remote host 1 connecting"
+  desktop <## "Compare session code with host:"
+  sessId <- getTermLine desktop
+  mobile <## "remote controller 1 connected"
+  mobile <## "Compare session code with controller and use:"
+  mobile <## ("/verify remote ctrl " <> sessId)
+  mobile ##> ("/verify remote ctrl " <> sessId)
+  mobile <## "remote controller 1 session started with My desktop"
+  desktop <## "remote host 1 connected"
+  stopMobile mobile desktop
+
 remoteMessageTest :: HasCallStack => FilePath -> IO ()
 remoteMessageTest = testChat3 aliceProfile aliceDesktopProfile bobProfile $ \mobile desktop bob -> do
   startRemote mobile desktop