I have errors whereby connections to my Istio Gateway fails during the SSL handshake. I checked the packets and here is what is happening:
t+00s - CLIENT ---> SERVER: SYN
t+00s - SERVER ---> CLIENT: SYN, ACK
t+00s - CLIENT ---> SERVER: ACK
t+15s - SERVER ---> CLIENT: FIN, ACK
t+15s - CLIENT ---> SERVER: ACK
t+45s - CLIENT ---> SERVER: "client hello"
t+45s - SERVER ---> CLIENT: RST
On a normal execution, the flow is very different:
t+00s - CLIENT ---> SERVER: SYN
t+00s - SERVER ---> CLIENT: SYN, ACK
t+00s - CLIENT ---> SERVER: "Client Hello"
t+00s - SERVER ---> CLIENT: ACK
t+00s - SERVER ---> CLIENT: "Server hello"
t+00s - SERVER ---> CLIENT: Sends its certificate
t+00s - SERVER ---> CLIENT: Server key exchange
t+00s - CLIENT ---> SERVER: ACK
t+00s - CLIENT ---> SERVER: ACK
t+00s - CLIENT ---> SERVER: Client key exchange
t+00s - SERVER ---> CLIENT: New session ticket
t+00s - CLIENT ---> SERVER: ACK
... data / ack ...
Other than there is a latency at the client level (which I am looking into), I am wondering what is the reason for the 15 seconds timeout while waiting for the client hello . This is a timeout that I can reproduce and it is always set to 15 seconds - i.e. if the client hello is not received within 15 seconds the server will be sending a FIN-ACK. But what I want to understand is where this comes from. I tried to edit the tcp connection timeout but this had no effect on this timeout
Changes done:
apiVersion: [networking.istio.io/v1alpha3](http://networking.istio.io/v1alpha3)
kind: DestinationRule
metadata:
....
spec:
host: [example.com](http://example.com/)
trafficPolicy:
connectionPool:
tcp:
connectTimeout: 5s
This change has no effect, and I am also struggling to see where it takes effect. When I checked the logs on the pilot there is no report of any error, however this change does not see reflected anywhere when I tried to check it: istioctl --kubeconfig=kubeconfig pc routes my-ingress-gateway-pod.istio-system --name https.443.https.istio-gateway.istio-system -o json