<h3>Bug Description</h3>
<p>My cluster uses Istio and one of service (java) which is deployed in mesh needs to connect to external resource <code>x.cmp.net/doc.pdf</code> with http and 443 port. This external resource using trusted wildcard cert (DigiCert) with subjects <code>*.cmp.net</code> and <code>cmp.net</code>.
When I try to use openssl to verify (from app container) ssl cert I'm getting <strong>Google cert</strong> (?? istio cert ?):</p>
<pre><code>opt$ **openssl s_client -showcerts -connect x.cmp.net:443**
CONNECTED(00000003)
depth=2 C = US, O = Google Trust Services LLC, CN = GTS Root R1
verify return:1
depth=1 C = US, O = Google Trust Services LLC, CN = GTS CA 1C3
verify return:1
depth=0 CN = *.google.com
verify return:1
---
Certificate chain
 0 s:CN = *.google.com

</code></pre>
<p>Application is written in java and when app tries to download resource getting:</p>
<pre><code>No subject alternative DNS name matching shipjobmt.ista.net found.
</code></pre>
<p>My configuration:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: internalnet
  namespace: ppct
spec:
  hosts:
    - x.cmp.net
    - y.cmp.net
    - z.cmp.net
  exportTo:
    - &quot;.&quot;
  ports:
    - number: 443
      name: https
      protocol: HTTPS
  location: MESH_EXTERNAL
  resolution: DNS
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: xinternalnet
  namespace: ppct
spec:
  host: x.cmp.net
  trafficPolicy:
    tls:
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: yinternalnet
  namespace: ppct
spec:
  host: y.cmp.net
  trafficPolicy:
    tls:
      mode: SIMPLE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: zinternalnet
  namespace: ppct
spec:
  host: z.cmp.net
  trafficPolicy:
    tls:
      mode: SIMPLE
</code></pre>
<p><strong>I also have blocking mode on:</strong></p>
<pre><code>kubectl get istiooperator installed-state -n istio-system -o jsonpath='{.spec.meshConfig.outboundTrafficPolicy.mode}'
REGISTRY_ONLY
</code></pre>
<h3>Version</h3>
<pre><code>`istioctl version`
client version: 1.11.0
control plane version: 1.11.0
data plane version: 1.11.0 (65 proxies)


`kubectl version --short`
Client Version: v1.19.9
Server Version: v1.19.9
</code></pre>
<h3>Additional Information</h3>
<p><em>No response</em></p>

<p>Your problem seems to be linked to double TLS (you can read more <a href="https://istio.io/latest/docs/ops/common-problems/network-issues/#double-tls" rel="nofollow noreferrer">here</a>).
There are two possible solutions:</p>
<h3>Solution 1</h3>
<p>In <code>ServiceEntry</code> define protocol as HTTP with redirection to 443</p>
<pre class="lang-yaml prettyprint-override"><code>spec:
  hosts:
  - ...
  ports:
  - number: 80
    name: http
    protocol: HTTP
    targetPort: 443
</code></pre>
<h3>Solution 2</h3>
<p>Disable TLS for outgoing traffic with <code>DestinationRule</code></p>
<pre class="lang-yaml prettyprint-override"><code>trafficPolicy:
  tls:
    mode: DISABLE
</code></pre>
