Login fails with "bad protocol version"

Help
1

I’ve just updated my selfhosted Atuin to 18.19. On the two linux machines I have, everything went fine, but somehow the mac now refuses to login:

Error: error sending request for url (https://my-own-atuin.example/login)

Caused by:
   0: client error (Connect)
   1: bad protocol version

Location:
    crates/atuin-client/src/api_client.rs:149:16

On that machine Atuin is installed with Homebrew; I’ve tried with and without the daemon, but that doesn’t make a difference in the symptoms. I can reach the server using curl:

$ curl https://my-own-atuin.example/healthz
{"status":"healthy"}

Output of atuin doctor:

{
  "atuin": {
    "version": "18.19.0",
    "commit": "",
    "sync": null,
    "sqlite_version": "3.46.0",
    "daemon_enabled": false
  },
  "shell": {
    "name": "zsh",
    "default": "zsh",
    "plugins": [
      "atuin"
    ],
    "preexec": "built-in"
  },
  "system": {
    "os": "Darwin",
    "arch": "arm64",
    "version": "26.5.2",
    "disks": ...

edit I’ve downgraded the mac to atuin 18.18.1 and it works… so that does look like a regression

2

Hi, same issue here.

I investigated this with a friend, and we found that this issue occurs after the switch from rustls to native-tls (clearly mentioned in the release notes, but i also missed that). On macOS, using native-tls means using the Security.framework, which does not support TLSv1.3, yes you read that correctly.

I’m guessing now: like me, your server is behind a reverse proxy that enforces TLSv1.3 and rejects TLSv1.2. You can confirm this locally with

$ echo | openssl s_client -connect atuin.mydomain:443 -servername atuin.mydomain -tls1_2
80213CF701000000:error:0A00042E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:918:SSL alert number 70

This is what causes the bad protocol error you saw. At least, that was the case for me with atuin 18.19+

I personally chose to hop in here and tag Ellie, and in the meantime live with my patched homebrew formula that reinstantiates the rustls Cargo feature, you can see the formula homebrew-tap/Formula/atuin-rustls.rb at main · graelo/homebrew-tap · GitHub and install it via brew install graelo/tap/atuin-rustls. That’s a tap, so you should brew trust it first. I’ll take no offense if you prefer building it locally (that’s what I’d do for such a critical piece of software).

For @ellie , that would be awesome to fix this for macOS self-hosters :wink: Maybe keep building with rustls on macOS?

Cheers!

3

So we switched to native-tls to have better support for the local keychain, but will switch back in the next release.

We had issues in the past because reqwest didn’t support the latest rustls, and we had to use https://github.com/rustls/rustls-platform-verifier to get the keychain support.

This won’t make it into 18.22, but we will get it sorted for 18.23! Sorry for the bother