mTLS origination from egress gateway does not handle Redirect that contains `https` in the location

1

istio v 1.1
I was trying mutual tls origination example from the istio docs: https://doc.istio.cn/en/docs/examples/advanced-gateways/egress-gateway-mtls-origination/

I have setup an external server that expects mtls connections at example.com

  1. when the sleep pod invokes: http://example.com
    what I observe in the logs is:
    [sleep pod] --(http)–> [sidecar] --(mtls)–> [egress gw] --(mtls)–> [ext svc]

basically it works as expected

  1. sleep pod invokes: http://example.com/somepath
    somepath has a redirect to https://example.com/someotherpath
    Redirect to https then egress gw fails to intercept, app tries to connect to https and fails, because app does not have the server cert to negotiate mtls
  • SSL certificate problem: unable to get local issuer certificate
  • Closing connection 1
    curl: (60) SSL certificate problem: unable to get local issuer certificate

seems odd that there is no mention of how to handle redirects that expect to connect to https.
any strategies on how this is handled? use istio policies to inspect 30x headers and change location from https to http? seems like a base case that needs to be handled or mentioned in the docs to me.