kial Thank you for this clarification. Running Wireshark to sniff WLANs is very setup-dependant (see Capturing packets on wireless LANs and WLAN (IEEE 802.11) capture setup).
That's why we considered looking for other packet capturing tools that are more designated for this task.
That said, I'd like to add an important note that is missing in the first post - it's possible to successfully establish SSL connection to other sites by running the AT+CIPSTART="SSL" command, so we can understand we're missing something in the TLS handshake with Firebase, maybe version related.
That assumption is also based on multiple similar issues that are reported in Espressif's ESP8266_NONOS_SDK issues page in Git Hub,
Do you happen to know if there's a way to get more information from the Wi-Fi module behind the "ERROR" output we're getting by issuing AT commands other than packet capturing?