My platform version:
- AWS EKS 1.18
- istio 1.7.3
Hi, I have a problem when requesting via https. When I try to connect to "https://kinesis.ap-northeast-2.amazonaws.com" on ssl, I get ssl3_get_record:wrong version number error. However, SSL requests to "https://www.amazon.com" is working. Http request to "kinesis.ap-northeast-2.amazonaws.com:443" is also working. FYI, https request to kinesis on the router proxy is also working. I think this problem occurs with the sidecar proxy. Could you tell me how to fix it?
My debug log:
istio-proxy@xx-deployment-1:/$ curl https://kinesis.ap-northeast-2.amazonaws.com # SSL ERROR
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
istio-proxy@xx-deployment-1:/$ openssl s_client -connect kinesis.ap-northeast-2.amazonaws.com:443 -prexit -debug
CONNECTED(00000005)
write to 0x55da2e01a630 [0x55da2e02cbb0] (338 bytes => 338 (0x152))
0000 - 16 03 01 01 4d 01 00 01-49 03 03 d1 6c 8f 02 46 ....M...I...l..F
....
0150 - a6 18 ..
read from 0x55da2e01a630 [0x55da2e0238a3] (5 bytes => 5 (0x5))
0000 - 15 00 00 00 02 .....
140165107823040:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 9 (0x9))
0000 - 02 28 15 00 00 00 02 01-00 .(.......
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes => 0 (0x0))
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 14 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
http request on port 443 test:
root@xx-deployment-576c874974-g8pnn:/usr/src/app# curl -iv http://kinesis.ap-northeast-2.amazonaws.com:443
* Rebuilt URL to: http://kinesis.ap-northeast-2.amazonaws.com:443/
* Trying 54.230.155.14...
* TCP_NODELAY set
* Connected to kinesis.ap-northeast-2.amazonaws.com (54.230.155.14) port 443 (#0)
> GET / HTTP/1.1
> Host: kinesis.ap-northeast-2.amazonaws.com:443
> User-Agent: curl/7.52.1
> Accept: */*
>
< HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
< Server: CloudFront
Server: CloudFront
< Date: Wed, 10 Mar 2021 07:51:49 GMT
Date: Wed, 10 Mar 2021 07:51:49 GMT
< Content-Type: text/html
Content-Type: text/html
< Content-Length: 915
Content-Length: 915
< Connection: close
Connection: close
< X-Cache: Error from cloudfront
X-Cache: Error from cloudfront
< Via: 1.1 3dd24013b0b99bf4ea490be8808572d8.cloudfront.net (CloudFront)
Via: 1.1 3dd24013b0b99bf4ea490be8808572d8.cloudfront.net (CloudFront)
< X-Amz-Cf-Pop: ICN51-C2
X-Amz-Cf-Pop: ICN51-C2
< X-Amz-Cf-Id: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
X-Amz-Cf-Id: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
<
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>400 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Bad request.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)
Request ID: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
</PRE>
<ADDRESS>
</ADDRESS>
* Curl_http_done: called premature == 0
* Closing connection 0
My istio proxy config:
proxy:
autoInject: enabled
clusterDomain: cluster.local
componentLogLevel: 'misc:error'
enableCoreDump: false
excludeIPRanges: ''
excludeInboundPorts: ''
excludeOutboundPorts: ''
image: proxyv2
logLevel: warning
privileged: false
readinessFailureThreshold: 30
readinessInitialDelaySeconds: 1
readinessPeriodSeconds: 2
resources:
limits:
cpu: 2000m
memory: 1024Mi
requests:
cpu: 100m
memory: 128Mi
statusPort: 15020
tracer: zipkin
proxy_init:
image: proxyv2
resources:
limits:
cpu: 2000m
memory: 1024Mi
requests:
cpu: 10m
memory: 10Mi
My sidecar proxy container spec:
- name: istio-proxy
image: 'docker.io/istio/proxyv2:1.7.3'
args:
- proxy
- sidecar
- '--domain'
- $(POD_NAMESPACE).svc.cluster.local
- '--serviceCluster'
- xx.$(POD_NAMESPACE)
- '--proxyLogLevel=warning'
- '--proxyComponentLogLevel=misc:error'
- '--trust-domain=cluster.local'
- '--concurrency'
- '2'
My gateway container spec:
containers:
- name: istio-proxy
image: 'docker.io/istio/proxyv2:1.7.3'
args:
- proxy
- router
- '--domain'
- $(POD_NAMESPACE).svc.cluster.local
- '--proxyLogLevel=warning'
- '--proxyComponentLogLevel=misc:error'
- '--log_output_level=default:info'
- '--serviceCluster'
- xx-gateway
- '--trust-domain=cluster.local'
