0

When trying to redirect connection to salesforce custom domain through istio I am getting 503 inside the browser with the following message

upstream connect error or disconnect/reset before headers. retried and the latest reset reason: connection failure, transport failure reason: TLS error: 268436536:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR

The istio debug shows the following stack

debug   envoy pool queueing stream due to no available connections (ready=0 busy=0 connecting=0)
debug   envoy pool trying to create new connection
debug   envoy pool creating a new connection (connecting=0)
debug   envoy connection [C479766] current connecting state: true
debug   envoy client [C479766] connecting
debug   envoy connection [C479766] connecting to  <removedIP>:443
debug   envoy connection[C479766] connection in progress
debug   envoy connection [C479766] connected
debug   envoy connection [C479766] remote address: <removedIP>:443,TLS error: 268436536:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR
debug   envoy connection [C479766] closing socket: 0
debug   envoy connection [C479766] remote address: <removedIP>:443,TLS error: 268436536:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR
debug   envoy client [C479766] disconnect. resetting 0 pending requests
debug   envoy pool [C479766] client disconnected, failure reason: TLS error: 268436536:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR
debug   envoy router [C479765][S8990209301599029630] upstream reset: reset reason: connection failure, transport failure reason: TLS error: 268436536:SSL 
routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR
  • istio version 1.15
  • kubernetes version 1.24
mati kepa
  • 2,543
  • 19
  • 24

1 Answers1

0

we had to enable the Server Name Indication (SNI) for the destination route https://istio.io/latest/docs/reference/config/networking/destination-rule/#ClientTLSSettings to support edge akamai CDN networking

example yaml below

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
spec:
  host: xxx.my.site.com
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE
        sni: xxx.site.com

also more reading can be done >here<

mati kepa
  • 2,543
  • 19
  • 24