My platform version:
- EKS 1.18
- istio 1.7.3
Hi, I have a problem when requesting via https.
When I try to connect to “https://kinesis.ap-northeast-2.amazonaws.com” on ssl, I get ssl3_get_record:wrong version number error.
However, SSL requests to “https://www.amazon.com” is working. Http request to “kinesis.ap-northeast-2.amazonaws.com:443” is also working.
FYI, https request to kinesis on the router proxy is also working. I think this problem occurs with the sidecar proxy.
Could you tell me how to fix it?
My debug log:
istio-proxy@xx-deployment-1:/$ curl https://kinesis.ap-northeast-2.amazonaws.com # SSL ERROR
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
istio-proxy@xx-deployment-1:/$ openssl s_client -connect kinesis.ap-northeast-2.amazonaws.com:443 -prexit -debug
CONNECTED(00000005)
write to 0x55da2e01a630 [0x55da2e02cbb0] (338 bytes => 338 (0x152))
0000 - 16 03 01 01 4d 01 00 01-49 03 03 d1 6c 8f 02 46 ....M...I...l..F
....
0150 - a6 18 ..
read from 0x55da2e01a630 [0x55da2e0238a3] (5 bytes => 5 (0x5))
0000 - 15 00 00 00 02 .....
140165107823040:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 9 (0x9))
0000 - 02 28 15 00 00 00 02 01-00 .(.......
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 0 (0x0))
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 14 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
My istio proxy config:
proxy:
autoInject: enabled
clusterDomain: cluster.local
componentLogLevel: 'misc:error'
enableCoreDump: false
excludeIPRanges: ''
excludeInboundPorts: ''
excludeOutboundPorts: ''
image: proxyv2
logLevel: warning
privileged: false
readinessFailureThreshold: 30
readinessInitialDelaySeconds: 1
readinessPeriodSeconds: 2
resources:
limits:
cpu: 2000m
memory: 1024Mi
requests:
cpu: 100m
memory: 128Mi
statusPort: 15020
tracer: zipkin
proxy_init:
image: proxyv2
resources:
limits:
cpu: 2000m
memory: 1024Mi
requests:
cpu: 10m
memory: 10Mi
My sidecar proxy container spec:
- name: istio-proxy
image: 'docker.io/istio/proxyv2:1.7.3'
args:
- proxy
- sidecar
- '--domain'
- $(POD_NAMESPACE).svc.cluster.local
- '--serviceCluster'
- xx.$(POD_NAMESPACE)
- '--proxyLogLevel=warning'
- '--proxyComponentLogLevel=misc:error'
- '--trust-domain=cluster.local'
- '--concurrency'
- '2'
My gateway container spec:
containers:
- name: istio-proxy
image: 'docker.io/istio/proxyv2:1.7.3'
args:
- proxy
- router
- '--domain'
- $(POD_NAMESPACE).svc.cluster.local
- '--proxyLogLevel=warning'
- '--proxyComponentLogLevel=misc:error'
- '--log_output_level=default:info'
- '--serviceCluster'
- xx-gateway
- '--trust-domain=cluster.local'