What to do if Teleport stops working with an error: ERROR: connection error: tls: first record does not look like a TLS handshake

When using teleport to access services at ECMWF like our Atos HPCF and ECGATE services, some users will get a "Connection Successful" screen in the browser, but experience an error similar to this one in the terminal: 

$ tsh login --proxy=jump.ecmwf.int
If browser window does not open automatically, open it by clicking on the link:
 http://127.0.0.1:37923/a56e4a1e-9917-408f-89cf-3a0c3bf87296
ERROR: connection error: desc = "transport: Error while dialing: failed to dial: unable to establish proxy stream\n\trpc error: code = Unavailable desc = connection error: desc = \"transport: authentication handshake failed: tls: first record does not look like a TLS handshake\""

In most cases, this error is caused by using a version of the tsh client that's higher than 13. Currently you should use a version of "tsh" equal to or lower than 13. We are working on removing this limitation in the very near future. 

You can check what version of tsh you're using with the "tsh version" command. 

$ tsh version
Teleport v14.1.1 git:api/v14.1.1-0-gfb6429e go1.21.3

As you can see in the above case, the error is related to the tsh client being version 14.1.1. 

This error will most often occur if you're installing the default version of teleport from their website or installing it via brew on Mac. If you get this error and you change to a version of teleport equal to or lower than 13 and the error persists, contact our support team.

You may follow the instructions in Teleport SSH Access for your Operating System to install the appropriate version for your platform.