Istio-proxy 403 error:'upstream connect error or disconnect/reset before headers. reset reason: connection failure'

[Sabyasachi2k]

It’s almost always because of the certs being used on the gateway. use the complete chain. I gave a similar soltution here

ISTIO_MUTUAL for gateway

The problem we faced is you have to give the complete chain in while creating the secret. We use SIMPLE for the TLS settings but hopefully this would work for ISTIO_MUTUAL as well. assuming your cert name is mycert.pfx here is the commands to get the complete chain openssl pkcs12 -in mycert.pfx -nokeys -chain | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > mycert.certs.pem here is the key command. open the pem and remove the BAG attributes. openssl pkcs12 -in mycert.pfx -nocerts -n…

hope that helps.