HTTPS LB Service on Istio


i’m having SSL_ERROR_SYSCALL error when trying to reach dns name of one of my LB services.

i have an istio deployed and i’ve enabled sidecar injector and added gateway and virtualservice to allow traffic to the mesh from my ingress, lets say “

for one of my services i have also LB IP that configured with dns ( i have certificate installed on this service.

when this service includes sidecar it cannot be reached through dns and i get this error.
when removing the envoy sidecar it start to work again.

what’s happening?
although the traffic does not flow through the ingress gateway , i still cannot use different certificate then the one used by istio?…