Https request to certain url is not working (ssl:wrong_version_number Error)

Networking
1

My platform version:

  • EKS 1.18
  • istio 1.7.3

Hi, I have a problem when requesting via https.
When I try to connect to “https://kinesis.ap-northeast-2.amazonaws.com” on ssl, I get ssl3_get_record:wrong version number error.
However, SSL requests to “https://www.amazon.com” is working. Http request to “kinesis.ap-northeast-2.amazonaws.com:443” is also working.
FYI, https request to kinesis on the router proxy is also working. I think this problem occurs with the sidecar proxy.
Could you tell me how to fix it?

My debug log:

istio-proxy@xx-deployment-1:/$ curl https://kinesis.ap-northeast-2.amazonaws.com # SSL ERROR
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

istio-proxy@xx-deployment-1:/$ openssl s_client -connect kinesis.ap-northeast-2.amazonaws.com:443 -prexit -debug
CONNECTED(00000005)
write to 0x55da2e01a630 [0x55da2e02cbb0] (338 bytes => 338 (0x152))
0000 - 16 03 01 01 4d 01 00 01-49 03 03 d1 6c 8f 02 46   ....M...I...l..F
....
0150 - a6 18                                             ..
read from 0x55da2e01a630 [0x55da2e0238a3] (5 bytes => 5 (0x5))
0000 - 15 00 00 00 02                                    .....
140165107823040:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 9 (0x9))
0000 - 02 28 15 00 00 00 02 01-00                        .(.......
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 0 (0x0))
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 14 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

My istio proxy config:

  proxy:
    autoInject: enabled
    clusterDomain: cluster.local
    componentLogLevel: 'misc:error'
    enableCoreDump: false
    excludeIPRanges: ''
    excludeInboundPorts: ''
    excludeOutboundPorts: ''
    image: proxyv2
    logLevel: warning
    privileged: false
    readinessFailureThreshold: 30
    readinessInitialDelaySeconds: 1
    readinessPeriodSeconds: 2
    resources:
      limits:
        cpu: 2000m
        memory: 1024Mi
      requests:
        cpu: 100m
        memory: 128Mi
    statusPort: 15020
    tracer: zipkin
  proxy_init:
    image: proxyv2
    resources:
      limits:
        cpu: 2000m
        memory: 1024Mi
      requests:
        cpu: 10m
        memory: 10Mi

My sidecar proxy container spec:

- name: istio-proxy
  image: 'docker.io/istio/proxyv2:1.7.3'
  args:
    - proxy
    - sidecar
    - '--domain'
    - $(POD_NAMESPACE).svc.cluster.local
    - '--serviceCluster'
    - xx.$(POD_NAMESPACE)
    - '--proxyLogLevel=warning'
    - '--proxyComponentLogLevel=misc:error'
    - '--trust-domain=cluster.local'
    - '--concurrency'
    - '2'

My gateway container spec:

  containers:
    - name: istio-proxy
      image: 'docker.io/istio/proxyv2:1.7.3'
      args:
        - proxy
        - router
        - '--domain'
        - $(POD_NAMESPACE).svc.cluster.local
        - '--proxyLogLevel=warning'
        - '--proxyComponentLogLevel=misc:error'
        - '--log_output_level=default:info'
        - '--serviceCluster'
        - xx-gateway
        - '--trust-domain=cluster.local'
2

I created another EKS cluster to test this error.
So, I figured out the problem was in this istio config.

spec:
 values:
  global:
   podDNSSearchNamespaces:
    - global

After I deleted “podDNSSearchNamespaces” key, https worked.