<p>We use istio to use distributed tracing. Our microservices sometimes need to hit external APIs, which usually communicate over https.</p>

<p>To measure the exact performance of the whole system, we want to trace the communication when hitting an external API.<br>
However, distributed tracing requires access to the header of the request, but https does not allow access because the header is encrypted.<br>
For confirmation, I deployed bookinfo on GKE with istio enabled, entered the productpage container of the productpage pod, and executed the following command.</p>

<pre><code>$ curl http://google.com
$ curl https://google.com
</code></pre>

<p>Only http communication was displayed on zipkin.</p>

<p>Is it possible to get a series of traces, including APIs that use external https?</p>

<p>Based on <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v2/config/trace/v2/trace.proto#config-trace-v2-tracing" rel="nofollow noreferrer">envoy documentation</a> it doesn't support https tracing.</p>

<blockquote>
  <p>The tracing configuration specifies global settings for the HTTP tracer used by Envoy. The configuration is defined by the Bootstrap tracing field. Envoy may support other tracers in the future, but right now the HTTP tracer is the only one supported.</p>
</blockquote>

<p>And this post on <a href="https://stackoverflow.com/questions/187655/are-https-headers-encrypted">stackoverflow</a></p>

<blockquote>
  <p>HTTPS (HTTP over SSL) sends all HTTP content over a SSL tunel, so HTTP content and headers are encrypted as well.</p>
</blockquote>

<p>I have even tried to reproduce that, but like in your case zipkin worked only for http.</p>

<p>Based on that I would say it's not possible to use zipkin to track https.</p>
