<p>Issue: I am trying to reach a vault cluster which is hosted on my k8's cluster using ingress.Currently using nginx ingress controller <code>0.10.2</code> version.</p>

<p>I am using custom generated TLS certs with Ingress which is pointing to the Vault cluster.I have the TLS certs in the same namespace as ingress.</p>

<p>Problem: Unable to reach the backend by providing the <code>vault status</code> command with the ca.crt for ingress.</p>

<p>Env variables set are</p>

<pre><code>        VAULT_ADDR=https://vault.ingress.staging.k8s.com
        VAULT_SKIP_VERIFY=true
</code></pre>

<p>Unable to get the status i.e the traffic is being stopped at the ingress itself. When I check the logs for the ingress controller it says</p>

<p><code>7 backend_ssl.go:146] unexpected error generating SSL certificate with full intermediate chain CA certs: Invalid certificate.</code></p>

<p>I have generated the custom TLS certs matching the Common Name of the Ingress resource. So unable to figure out why is this happening. Thought might be due to the wrong ingress annotations usage.</p>

<p>My question is there anything going wrong with <code>ingress.kubernetes.io/secure-backends: 'true'</code>, if yes can you provide info about how to use it? </p>

<p><strong>Notes:</strong></p>

<ul>
<li><p>I am using the appropriate ingress class and know that there is no problem with that, for sure.</p></li>
<li><p>I have deployed few examples to check, if there is any problem with ingress. Even that is working fine.</p></li>
</ul>

<p><strong>* Can anyone provide a working example for <code>nginx.ingress.kubernetes.io/secure-backends</code> *</strong></p>

<p>Any solution related to this issue would be appreciated!!!</p>

<p><strong><em>Ingress.yaml</em></strong></p>

<pre><code>kind: Ingress
apiVersion: extensions/v1beta1
metadata:
  name: vault
  namespace: default
  annotations:
    ingress.kubernetes.io/secure-backends: 'true'
    kubernetes.io/ingress.class: "k8s"
spec:
  tls:
    - hosts:
        - vault.ingress.staging.k8s.com
      secretName: vault-server-ingress-tls
  rules:
    - host: vault.ingress.staging.k8s.com
      http:
        paths:
          - path: /
            backend:
              serviceName: example
              servicePort: 8200
</code></pre>

<p>You could try with:</p>

<pre><code>kubernetes.io/ingress.class: "&lt;your_class&gt;"
nginx.ingress.kubernetes.io/secure-backends: "true"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
</code></pre>

<p>Please keep in mind, that <code>ssl-passthrough</code> requires that additional command-line parameter has to be added to nginx-ingress-controller deployment (which is disabled by default):</p>

<pre><code>--enable-ssl-passthrough
</code></pre>

<p>Ref. <a href="https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#ssl-passthrough" rel="nofollow noreferrer">https://github.com/kubernetes/ingress-nginx/blob/master/docs/user-guide/nginx-configuration/annotations.md#ssl-passthrough</a></p>
