Does Prisma support TLS v1.3?

[felipe-ramirez]

Question

Currently I can use Prisma client (v5.11.0) to connect to an Amazon RDS Aurora PostgreSQL instance that has the parameter group setting ssl_min_protocol_version set to TLSv1.2 just fine with no problems. However, if I set that parameter to TLSv1.3 and try connecting again I get:

Error: Error: P1011: Error opening a TLS connection: bad protocol version

Does Prisma not support TLS v1.3 connections yet? I tried looking in the docs but couldn't find a definitive answer.

• OS: macOS
• Database: PostgreSQL
• Node.js version: v21.7.1

[ludralph]

Hi @felipe-ramirez 👋

Thank you for raising this question.

I can confirm that TLSV1.2 works while TLSv1.3 throws the same error you shared. I have shared this internally and will get back to you with any information from the team.

[ludralph]

Hi @felipe-ramirez

We have confirmation that Prisma works correctly with TLSv1.3. Can you please try again with the latest version of Prisma 6.2.1 and see if this is resolved for you?

[emmanuelnk]

Still broken on macOS as of Prisma 6.19.3 — the confirmation above only holds where native-tls binds OpenSSL.

Data point from today, macOS (Apple Silicon), Prisma 6.19.3, Postgres 17 on RDS with ssl_min_protocol_version = TLSv1.3:

PrismaClientInitializationError: Error opening a TLS connection: bad protocol version

• Root cause is below Prisma: the query engine does TLS via native-tls, which on macOS wraps Secure Transport — deprecated by Apple at TLS 1.2, never got 1.3 (only Network.framework did). See Windows unexpected or badly formatted, MacOS bad protocol version rust-native-tls/rust-native-tls#305.
• Same machine, same credentials, same server: works via the driver adapter (previewFeatures = ["driverAdapters"] + @prisma/adapter-pg), since node-postgres uses Node's OpenSSL. pg_stat_ssl confirms the connection negotiates TLSv1.3.
• Linux is unaffected (native-tls → OpenSSL), which is likely where the "works correctly with TLSv1.3" confirmation ran.

So: any macOS dev pointing Prisma ≤6.x (Rust engine) at a TLS 1.3-only Postgres will hit this; the driver adapter is the working escape hatch. Note the CLI (migrate dev, db pull) still uses the engine and remains affected.

[ludralph]

Hi there,

To keep our discussions organized and focused on the most relevant topics, we’re reviewing and tidying up our backlog. As part of this process, we’re closing discussions that haven’t had any recent activity and appear to be outdated.

If this discussion is still important to you or unresolved, we’d love to hear from you! Feel free to reopen it or start a new one with updated details.

For more details about our priorities and vision for the future of Prisma ORM, check out our latest blog post: https://www.prisma.io/blog/prisma-orm-manifesto.

Thank you for your understanding and being part of the community!;