diff --git a/ql-application/threadx/interface/custom_app/mp3_player.c b/ql-application/threadx/interface/custom_app/mp3_player.c
index be5046a..9704d91 100644
--- a/ql-application/threadx/interface/custom_app/mp3_player.c
+++ b/ql-application/threadx/interface/custom_app/mp3_player.c
@@ -6,8 +6,10 @@
 #include "ql_application.h"
 #include "ql_audio.h"
 #include "ql_iic.h"
-#include "ql_gpio.h"
-#include "ql_fs.h"
+#include "ql_gpio.h"
+#include "ql_fs.h"
+#include "ql_http_client.h"
+#include "talkingq_wss.h"
 
 #include "webclient.h"
 #include <netdb.h>
@@ -29,7 +31,105 @@ static int mp3_player_end_frame = 0;
 int current_sample_rate = 0;
 static	audio_track_handle track_hd;
 
-static unsigned short pcm_buff[1152*2]={0x00};
+static unsigned short pcm_buff[1152*2]={0x00};
+
+typedef struct
+{
+	uint8_t *buffer;
+	size_t capacity;
+	size_t length;
+	int status_code;
+	int overflow;
+} https_mp3_recv_t;
+
+/* HTTPS MP3 下载回调：直接把响应体写入播放器的内存缓冲区。 */
+static int https_mp3_response_cb(QL_HTTP_CLIENT_T *client,
+	QL_HTTP_CLIENT_EVENT_E event, int status_code,
+	char *data, int data_len, void *private_data)
+{
+	https_mp3_recv_t *recv = (https_mp3_recv_t *)private_data;
+	(void)client;
+
+	if(recv == NULL){
+		return 0;
+	}
+
+	switch(event){
+		case QL_HTTP_CLIENT_EVENT_RECV_HEADER_FINISHED:
+			recv->status_code = status_code;
+			return status_code == 200 ? 1 : 0;
+		case QL_HTTP_CLIENT_EVENT_RECV_BODY:
+			if(data == NULL || data_len <= 0){
+				return 1;
+			}
+			if(recv->length + (size_t)data_len > recv->capacity){
+				recv->overflow = 1;
+				return 0;
+			}
+			memcpy(recv->buffer + recv->length, data, (size_t)data_len);
+			recv->length += (size_t)data_len;
+			return 1;
+		case QL_HTTP_CLIENT_EVENT_RECV_BODY_FINISHED:
+			return 0;
+		default:
+			return 1;
+	}
+}
+
+/* 使用模组原生 HTTP 客户端拉取 HTTPS 音频。 */
+static int https_mp3_data_fetch(char *uri, uint8_t *buffer, size_t length)
+{
+	QL_HTTP_CLIENT_T *client = NULL;
+	https_mp3_recv_t recv = {buffer, length, 0, 0, 0};
+	QL_HTTP_CLIENT_ERR_E ret;
+	SSLConfig ssl_config = {
+		.en = 1,
+		.profileIdx = 1,
+		.serverName = "banban.api.talkingq.com",
+		.serverPort = 443,
+		.protocol = 0,
+		.dbgLevel = 0,
+		.sessionReuseEn = 0,
+		.vsn = SSL_VSN_ALL,
+		.verify = SSL_VERIFY_MODE_REQUIRED,
+		.cert.from = SSL_CERT_FROM_BUF,
+		.cert.path.rootCA = (char *)talkingq_root_ca,
+		.cert.path.clientKey = NULL,
+		.cert.path.clientCert = NULL,
+		.cert.clientKeyPwd.data = NULL,
+		.cert.clientKeyPwd.len = 0,
+		.cipherList = "ALL",
+		.CTRDRBGSeed.data = NULL,
+		.CTRDRBGSeed.len = 0
+	};
+
+	client = ql_http_client_init();
+	if(client == NULL){
+		printf("https mp3 client init failed\n");
+		return -1;
+	}
+
+	ql_http_client_setopt(client, QL_HTTP_CLIENT_OPT_ASYN, 0);
+	ql_http_client_setopt(client, QL_HTTP_CLIENT_OPT_PDP_CID, 1);
+	ql_http_client_setopt(client, QL_HTTP_CLIENT_OPT_PROTOCOL_VER, 1);
+	ql_http_client_setopt(client, QL_HTTP_CLIENT_OPT_SSL_CTX, &ssl_config);
+
+	ret = ql_http_client_request(client, uri, QL_HTTP_CLIENT_REQUEST_GET,
+		QL_HTTP_CLIENT_AUTH_TYPE_NONE, NULL, NULL, NULL, 0,
+		https_mp3_response_cb, &recv);
+	ql_http_client_release(client);
+
+	if(ret != QL_HTTP_CLIENT_ERR_SUCCESS || recv.status_code != 200 ||
+	   recv.overflow || recv.length == 0){
+		printf("https mp3 download failed, ret:%d status:%d size:%d overflow:%d\n",
+			(int)ret, recv.status_code, (int)recv.length, recv.overflow);
+		return -1;
+	}
+
+	total_length = (int)recv.length;
+	printf("https mp3 download success, size:%d\n", total_length);
+	return total_length;
+}
 
 struct mp3_decoder
 {
@@ -392,8 +492,10 @@ void aofei_mp3_player(char *file_name)
 
 	memset(mp3_buff, 0, 100*1024);
 	//直接下载到一个100k的buffer
-	if(strstr(file_name, "http:")){//播放url
-		ret = url_mp3_data_fetch(file_name, mp3_buff, 100*1024);
+	if(strncmp(file_name, "https://", 8) == 0){//播放HTTPS URL
+		ret = https_mp3_data_fetch(file_name, mp3_buff, 100*1024);
+	}else if(strncmp(file_name, "http://", 7) == 0){//播放HTTP URL
+		ret = url_mp3_data_fetch(file_name, mp3_buff, 100*1024);
 	}else if(strstr(file_name, "test.mp3")){//播放本地音频
 		total_length = test_data_size;
 		memcpy(mp3_buff, test_data, total_length);
diff --git a/ql-application/threadx/interface/custom_app/ws_talkingq.c b/ql-application/threadx/interface/custom_app/ws_talkingq.c
index d123c37..327c80d 100644
--- a/ql-application/threadx/interface/custom_app/ws_talkingq.c
+++ b/ql-application/threadx/interface/custom_app/ws_talkingq.c
@@ -29,6 +29,8 @@
 
 
 #define PCM_FRAME_LENGTH    1152
+#define CLOUD_TTS_ERROR_URL_FORMAT \
+    "https://banban.api.talkingq.com/assets/roles/banban/tts_error/tts_error%02u.mp3"
 
 static int g_sim_ready = 0;
 
@@ -188,13 +190,12 @@ static void remove_underscores(char *str) {
 }
 
 /*
- * 将后台下发的对话超时音频 URL 改为 00~09 中的一条。
- * 只替换 URL 末尾的文件名，域名和目录保持不变；同时兼容旧文件名 tts_error.mp3。
+ * 将后台下发的任意角色对话超时音频 URL 改为 banban 角色的 HTTPS 地址，
+ * 并在 tts_error00~tts_error09 中随机选择一条。
  */
 static int randomize_tts_error_url(char *url, size_t url_size)
 {
     char *file_name;
-    size_t remain_size;
     unsigned int random_index;
     int written;
 
@@ -205,15 +206,14 @@ static int randomize_tts_error_url(char *url, size_t url_size)
     file_name = strrchr(url, '/');
     file_name = (file_name == NULL) ? url : file_name + 1;
 
-    if(strcmp(file_name, "tts_err.mp3") != 0 &&
-       strcmp(file_name, "tts_error.mp3") != 0){
+    if(strncmp(file_name, "tts_error", strlen("tts_error")) != 0 &&
+       strncmp(file_name, "tts_err", strlen("tts_err")) != 0){
         return 0;
     }
 
-    remain_size = url_size - (size_t)(file_name - url);
     random_index = hal_os_get_rand() % 10;
-    written = snprintf(file_name, remain_size, "tts_err%02u.mp3", random_index);
-    if(written < 0 || (size_t)written >= remain_size){
+    written = snprintf(url, url_size, CLOUD_TTS_ERROR_URL_FORMAT, random_index);
+    if(written < 0 || (size_t)written >= url_size){
         printf("random tts error url buffer too small\n");
         return -1;
     }
@@ -291,17 +291,28 @@ static void onmessage_text(rws_socket socket, const char *text, const unsigned i
 			
 		}else{//TTS_URL:audio_url
 			wss_connect_start = 0;
-			char *ret_str1= strstr(text, "http:");
-			char *ret_str2= strstr(text, ".mp3");
-			int len = 0;
+			char *ret_str1 = strstr(text, "https://");
+			char *ret_str2 = NULL;
+			size_t url_len = 0;
 			int is_tts_error_url = 0;
+			if(ret_str1 == NULL){
+				ret_str1 = strstr(text, "http://");
+			}
+			if(ret_str1 != NULL){
+				ret_str2 = strstr(ret_str1, ".mp3");
+			}
 			if(ret_str1!=NULL && ret_str2!=NULL){
-	
-				len = strlen(ret_str1)-strlen(ret_str2);
-				strncpy(url_buff, ret_str1, len);
-				sprintf(url_buff+len, "%s", ".mp3");
 
-				/* 后台 URL 不变，由设备随机选择 tts_err00~tts_err09 */
+				/* 提取完整的 HTTP/HTTPS MP3 URL，结尾额外包含“.mp3”四个字符 */
+				url_len = (size_t)(ret_str2 - ret_str1) + strlen(".mp3");
+				if(url_len >= sizeof(url_buff)){
+					printf("audio url too long:%d\n", (int)url_len);
+					return;
+				}
+				memcpy(url_buff, ret_str1, url_len);
+				url_buff[url_len] = '\0';
+
+				/* 两个角色统一使用 banban 的 HTTPS 随机超时提示音 */
 				is_tts_error_url = randomize_tts_error_url(url_buff, sizeof(url_buff));
 				if(is_tts_error_url < 0){
 					return;