错误:1400410B: ingressgateway上https的SSL routines:CONNECT_CR_SRVR_HELLO:wrong版本号
我试图在ingressgateway上的端口443上设置SSL。我可以用一个非常基本的设置来不断地复制。我知道这可能是我做错了什么，但还没能弄清楚。
我的k8s集群正在EKS上运行。k version 1.19
我用为域api.foo.com和其他名称*.api.foo.com创建了一个证书该证书已成功创建并具有ARN arn:aws:acm:us-west-2:<some-numbers>:certificate/<id>
然后我安装了istio：istioctl install --set meshConfig.accessLogFile=/dev/stdout。
随附版本：
client version: 1.7.0
control plane version: 1.7.0这是我的网关定义：
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: foo-gateway
annotations:
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:us-west-2:<some-numbers>:certificate/<id>"
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "60"
service.beta.kubernetes.io/aws-load-balancer-type: "elb"
spec:
selector:
istio: ingressgateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*"
- port:
number: 443
name: https-443
protocol: HTTP
hosts:
- "*"注意，端口443有协议HTTP，我不认为这是问题(因为我想使用SSL终端)。而且，即使我将其更改为HTTPS，也会得到以下内容：
Resource: "networking.istio.io/v1alpha3, Resource=gateways", GroupVersionKind: "networking.istio.io/v1alpha3, Kind=Gateway"
Name: "foo-gateway", Namespace: "default"
for: "foo-gateway.yaml": admission webhook "validation.istio.io" denied the request: configuration is invalid: server must have TLS settings for HTTPS/TLS protocols那么tls的设置是什么呢？我需要通过未放在/etc中的注释(来自AWS )获取证书密钥。顺便说一句，是否有一种不需要ssl终止的方法来做到这一点？
我的VirtualService定义是：
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: foo-api
spec:
hosts:
- "*"
gateways:
- foo-gateway
http:
- match:
- uri:
prefix: /users
route:
- destination:
host: https-user-manager
port:
number: 7070然后，我在端口7070上k apply -f了一个名为https-user-manager的超级简单REST服务。然后，我从k get svc -n istio-system中找到负载均衡器的主机名，其结果是：
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
istio-ingressgateway LoadBalancer <cluster-ip> blahblahblah.us-west-2.elb.amazonaws.com 15021:30048/TCP,80:30210/TCP,443:31349/TCP,15443:32587/TCP 32m我可以成功地使用http：curl http://blahblahblah.us-west-2.elb.amazonaws.com/users并获得一个有效的响应。
但是，如果我这样做：curl -vi https://blahblahblah.us-west-2.elb.amazonaws.com/users，我得到以下信息：
* Trying <ip>...
* TCP_NODELAY set
* Connected to api.foo.com (<ip>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number
* Closing connection 0
curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong version number我做错了什么？我见过https://medium.com/faun/managing-tls-keys-and-certs-in-istio-using-amazons-acm-8ff9a0b99033、Istio-ingressgateway with https - Connection refused、Setting up istio ingressgateway、SSL Error - wrong version number (HTTPS to HTTP)、Updating Istio-IngressGateway TLS Cert、https://github.com/kubernetes/ingress-nginx/issues/3556、https://github.com/istio/istio/issues/14264、https://preliminary.istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/、https://preliminary.istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/等许多我都不记得的东西。会很感激你的帮助！
回答 1
Stack Overflow用户
发布于 2021-12-23 12:37:09
low level nginx
ssl on;
high level nginx
listen 443 ssl; 这个对我有用
https://stackoverflow.com/questions/64732723
复制相似问题
腾讯云开发者
