<p>I have created kubernetes ingress with frontend config and the ECDSA P-384 TLS cert on Google Cloud Platform, after few seconds of creating process i received the followind error:</p>
<blockquote>
<p>Error syncing to GCP: error running load balancer syncing routine:
loadbalancer <em><strong><strong><strong>-default-</strong></strong></strong>-ingress-</em>****** does not exist:
Cert creation failures -
k8s2-cr-<em><strong><strong>-</strong></strong></em><em><strong><strong><strong><strong><strong><strong>-</strong></strong></strong></strong></strong></strong></em>***** Error:googleapi:
Error 400: The ECDSA curve is not supported.,
sslCertificateUnsupportedCurve</p>
</blockquote>
<p>Why The ECDSA curve is not supported? Is there any way to enable this support?</p>
<p>Create tls-secret command:</p>
<pre><code>kubectl create secret tls tls --key [key-path] --cert [cert-path]
</code></pre>
<p>Frontend-config:</p>
<pre><code>apiVersion: networking.gke.io/v1beta1
kind: FrontendConfig
metadata:
  name: frontend-config
spec:
  redirectToHttps:
  enabled: true
  responseCodeName: MOVED_PERMANENTLY_DEFAULT
</code></pre>
<p>Ingress:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress
  namespace: default
  labels:
    kind: ingress
  annotations:
    networking.gke.io/v1beta1.FrontendConfig: frontend-config
spec:
  tls:
  - hosts:
    - '*.mydomain.com'
    secretName: tls
  rules:
  - host: mydomain.com
    http:
      paths:
      - path: /*
        pathType: ImplementationSpecific
        backend:
          service:
            name: spa-ingress-service
            port:
              number: 80
  - host: api.mydomain.com
    http:
      paths:
      - path: /*
        pathType: ImplementationSpecific
        backend:
          service:
            name: api-ingress-service
            port:
              number: 80
</code></pre>
<p>spa services:</p>
<pre><code># SERVICE LOAD BALANCER
apiVersion: v1
kind: Service
metadata:
  name: spa-service
  labels:
    app/name: spa
spec:
  type: LoadBalancer
  selector:
    app/template: spa
  ports:
  - name: http
    protocol: TCP
    port: 80
    targetPort: http
---
# SERVICE NODE PORT - FOR INGRESS
apiVersion: v1
kind: Service
metadata:
  name: spa-ingress-service
  labels:
    app/name: ingress.spa
spec:
  type: NodePort
  selector:
    app/template: spa
  ports:
  - name: https
    protocol: TCP
    port: 80
    targetPort: http
</code></pre>
<p>api services:</p>
<pre><code># SERVICE LOAD BALANCER
apiVersion: v1
kind: Service
metadata:
  name: api-service
  labels:
    app/name: api
spec:
  type: LoadBalancer
  selector:
    app/template: api
  ports:
  - name: http
    protocol: TCP
    port: 80
    targetPort: http
---
# SERVICE NODE PORT - FOR INGRESS
apiVersion: v1
kind: Service
metadata:
  name: api-ingress-service
  labels:
    app/name: ingress.api
spec:
  type: NodePort
  selector:
    app/template: api
  ports:
  - name: https
    protocol: TCP
    port: 80
    targetPort: http
</code></pre>
<p>kubectl describe ingress response:</p>
<p><img src="https://i.stack.imgur.com/Ywsie.jpg" alt="describe" /></p>

<p>The gcp <a href="https://cloud.google.com/load-balancing/docs/ssl-certificates/self-managed-certs#private-key" rel="nofollow noreferrer">load balancer</a> supports <strong>RSA-2048 or ECDSA P-256</strong> certificates.  Also DownstreamTlsContexts support multiple TLS certificates. These may be a mix of RSA and <a href="https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl#certificate-selection" rel="nofollow noreferrer">P-256 ECDSA</a> certificates.</p>
<p>The following error is due to the incompatibility with the P-384 certificate currently being used rather than the P-256 certificate.</p>
<p>For additional information refer to the <a href="https://cloud.google.com/load-balancing/docs/l7-internal" rel="nofollow noreferrer">Load Balancing Overview</a>.</p>
