Kubernetes NGINX ingress doesn't send the right certificate during SSL handshake

Question

Greetings.

I have two dockerized applications accessible through an ingress controller nginx on an AKS Cluster.

Both of my applications are coded with Java SPRING. One of my application have to access the other one through SSL and so make an SSL Handshake.

The problem is that when I access my application from the other one, I have an error during the SSL handshake saying that the cert sent by the server is a Kubernetes Fake certificate. In an other hand, when I try to access the application from my browser, everything works perfectly and I have the right cert not the Kubernetes Fake one.

I really don't understand what is the problem here.

Answer 1

Hello, @Issam Sisbane !

Why is NGINX giving me a fake certificate error?

There are 3 conditions that need to be met for NGINX to show the correct certificate. If any of the conditions are not met, then you will see the fake certificate issue you are describing:

1. The CN (Common Name) field (or at least one of the SANs/Subject Alternative Names) in the certificate.
2. The host field in the ingress rule.
3. The host used by the client to make the request.

If one of these does not match, then the client will be presented with a fake certificate.

The first suggestion would be to confirm which hostname/FQDN is being invoked by the client in this case. Is it the same one that is used when accessing using the browser?