<p>first post on stack overflow, hope i will get some help :)</p>
<p>I've been struggling for a while trying to get this to work.
So basically i have kubernetes cluster in Oracle Cloud.
I'm using nginx ingress controller + cert manager for certificates.</p>
<p>When i deployed nginx ingress controller Oracle Cloud provided me with Load Balancer.</p>
<p>So we come to my problem. By default Load Balancer got listeners in cloud using TCP protocol (here is pic)
<a href="https://i.stack.imgur.com/18IhS.png" rel="nofollow noreferrer">TCP Listener</a></p>
<p>And in kubernetes service (nginx ingress controller) protocol is tcp also.</p>
<p>When this setup is used it is working all fine.</p>
<p>Also im using SNI (multiple service on one endpoint).</p>
<p>But Oracle Cloud provides WAF that can be used with only http listeners (one more pic)
<a href="https://i.stack.imgur.com/fpcGR.png" rel="nofollow noreferrer">Http listener</a>.
So if i intend to use WAF i need to set this http listeners on Load Balancer.</p>
<p>This is nginx ingress service pic where you can see protocol is TCP.
<a href="https://i.stack.imgur.com/DRHMf.png" rel="nofollow noreferrer">TCP nginx ingress service</a></p>
<p>When i change listeners to http. My domain have this error &quot;ERR_SSL_PROTOCOL_ERROR&quot; when i try to open it on browser.</p>
<p>I tried many things including changing configuration of nginx ingress controller, adding annotations etc..</p>
<pre><code>nginx.ingress.kubernetes.io/backend-protocol: HTTP
nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
nginx.ingress.kubernetes.io/ssl-redirect: 'true'
</code></pre>
<p>But nothing works i always get that &quot;ERR_SSL_PROTOCOL_ERROR&quot;.</p>
<p>So i don't know is this even possible, and by that i mean can there be http listeners that point on  tcp protocol (nginx ingress service)?</p>
<p>Any advice would be appreciated.</p>
<p>Thank you in advance.</p>

<p>OCI <strong>TCP</strong> listeners to <strong>HTTP</strong> listeners backed as HTTPS or SSL passthrough.</p>
<p>You can first create the <strong>self-sign</strong> <strong>SSL</strong> <strong>certificate</strong> if you are attaching it at the <strong>LB</strong> level.</p>
<p>If you are using cert-manager and saving it into a secret that's fine you can also follow it.</p>
<p>You can go to LoadBalancer and change the Protocol or Listeners to <strong>HTTP</strong> instead of <strong>TCP</strong> manually and attach the certificate to <strong>LB</strong> on the <strong>443</strong> <strong>port</strong> if you are following that method (as i did).</p>
<p>Next</p>
<p>Go to <strong>Nginx ingress controller svc</strong> and edit it and change the target port for <strong>443</strong> to <strong>http</strong></p>
<p><a href="https://i.stack.imgur.com/GT0EM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GT0EM.png" alt="enter image description here" /></a></p>
<p><a href="https://i.stack.imgur.com/PJRtv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/PJRtv.png" alt="enter image description here" /></a></p>
<p>Now inside your app ingress configuration you can use the <strong>annotations</strong> it will work without error of <code>400 Bad request</code> or <code>HTTP requested on HTTPS</code> port</p>
<pre><code>nginx.ingress.kubernetes.io/backend-protocol: HTTPS
nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
nginx.ingress.kubernetes.io/ssl-redirect: 'true'
</code></pre>
