{"action":"opened","issue":{"url":"https://api.github.com/repos/linkerd/linkerd/issues/1920","repository_url":"https://api.github.com/repos/linkerd/linkerd","labels_url":"https://api.github.com/repos/linkerd/linkerd/issues/1920/labels{/name}","comments_url":"https://api.github.com/repos/linkerd/linkerd/issues/1920/comments","events_url":"https://api.github.com/repos/linkerd/linkerd/issues/1920/events","html_url":"https://github.com/linkerd/linkerd/issues/1920","id":317876340,"number":1920,"title":"TLS handshake failure when connecting to an AWS API Gateway with SNI and private DNS","user":{"login":"xinyuliu-glu","id":12803373,"avatar_url":"https://avatars0.githubusercontent.com/u/12803373?v=4","gravatar_id":"","url":"https://api.github.com/users/xinyuliu-glu","html_url":"https://github.com/xinyuliu-glu","followers_url":"https://api.github.com/users/xinyuliu-glu/followers","following_url":"https://api.github.com/users/xinyuliu-glu/following{/other_user}","gists_url":"https://api.github.com/users/xinyuliu-glu/gists{/gist_id}","starred_url":"https://api.github.com/users/xinyuliu-glu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xinyuliu-glu/subscriptions","organizations_url":"https://api.github.com/users/xinyuliu-glu/orgs","repos_url":"https://api.github.com/users/xinyuliu-glu/repos","events_url":"https://api.github.com/users/xinyuliu-glu/events{/privacy}","received_events_url":"https://api.github.com/users/xinyuliu-glu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-26T04:46:36Z","updated_at":"2018-04-26T04:46:36Z","closed_at":null,"author_association":"NONE","body":"- [ ] Bug report\r\n\r\n**What happened**:\r\nFrom a Linkerd instance running on EC2, messages are routed to an AWS API Gateway endpoint with a private domain name. API Gateway creates HTTP endpoints for Lambda functions through CloudFront CDN. The connection failed due to a TLS handshake failure. However, we tried curl and a Java HttpsClient program on the same EC2 instance, they both connected to API Gateway private domain name without any issue.\r\n\r\n**What you expected to happen**:\r\nLinkerd should be able to connect to API Gateway endpoints through TLS + SNI.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\nCreate an API Gateway endpoint which proxies requests to a Lambda function - serverless architecture. \r\nIn Linkerd, route requests to the API Gateway endpoint with a custom domain name, an alias of the CloudFront domain name.\r\n\r\n**Anything else we need to know?**:\r\nLinkerd gives this error message: `Received+fatal+alert%3A+handshake_failure+at+remote+address%3A+server-54-222-19-212.iad12.r.cloudfront.net%2F54.222.19.212%3A443`\r\nthat suggests to me that it’s trying to connect to `server-54-222-19-212.iad121.r.cloudfront.net/54.230.19.212:443`\r\nand potentially sending that as the server_name instead of `bulkupload.integration.mycompany.services`.\r\n\r\n**Environment**:\r\n- linkerd/namerd version, config files:\r\n1.3.6\r\nclient:\r\n    tls:\r\n      commonName: \"integration.mycompany.services\"\r\n      disableValidation: true\r\n\r\n- Platform, version, and config files (Kubernetes, DC/OS, etc):\r\nEC2 ubuntu14 and 16\r\n\r\n- Cloud provider or hardware configuration:\r\nAWS"}}
{"actor":{"display_login":"xinyuliu-glu"}}