CODEWITHSUNDEEP
sslgoogle-kubernetes-engineistio
bakadevops
bakadevops

Reputation: 149

Istio Gateway MUTUAL TLS mode Not Working

I have created a GKE Cluster 1.18.17-gke.1901 and I have installed Istio 1.9.5 on it. My Ingress Gateway Service is of type: LoadBalancer.

I am trying to implement MUTUAL TLS mode in my istio-ingressgateway. The Gateway configuration looks like this:

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: mutual-domain
  namespace: test
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - mutual.domain.com
    port:
      name: mutual-domain-https
      number: 443
      protocol: HTTPS
    tls:
      credentialName: mutual-secret
      minProtocolVersion: TLSV1_2
      mode: MUTUAL

I have also setup a corresponding VirtualService and DestinationRule too.

Now, whenever I try to connect to https://mutual.domain.com I get the following error:

*   Trying 100.50.76.97...
* TCP_NODELAY set
* Connected to mutual.domain.com (100.50.76.97) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/cert.pem
  CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mutual.domain.com:443 
* Closing connection 0
curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to mutual.domain.com:443

If I change the tls: mode: to SIMPLE I am able to reach the service via the domain name but when it's MUTUAL the error above shows up.

The mutual-secret is a tls type Kubernets secret and it contains the tls.crt and tls.key.

$ kubectl describe mutual-secret
Name:         mutual-secret
Namespace:    istio-system
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/tls

Data
====
tls.crt:  4585 bytes
tls.key:  1674 bytes

Is there something missing? Why can't I access my service in MUTUAL mode but the same secret works for SIMPLE mode?

Upvotes: 0

Views: 1262

Answers (1)

user15659347
user15659347

Reputation:

Assuming you are following this.

It seems you are missing ca.crt in your secret. Create a new secret with tls.crt, tsl.key and ca.crt, and try again.

The ERR_BAD_SSL_CLIENT_AUTH_CERT error mentioned in the comments is Chrome/Chromium specific. It means the browser does not recognise Certificate Authority.

Add your CA certificate (.pem file) to Chrome/Chromium, you can follow this. Hopefully it will solve your problem.

Upvotes: 1

Related Questions