<p>I have a currently functioning Istio application. I would now like to add HTTPS using the Google Cloud managed certs. I setup the ingress there like this...</p>
<pre><code>apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: managed-cert
  namespace: istio-system
spec:
  domains:
    - mydomain.co
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: managed-cert-ingress
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.global-static-ip-name: managed-cert
    networking.gke.io/managed-certificates: managed-cert
    kubernetes.io/ingress.class: &quot;gce&quot;
spec:
  defaultBackend:
    service:
      name: istio-ingressgateway
      port:
        number: 443
---
</code></pre>
<p>But when I try going to the site (<a href="https://mydomain.co" rel="nofollow noreferrer">https://mydomain.co</a>) I get...</p>
<pre><code>Secure Connection Failed

An error occurred during a connection to earth-615.mydomain.co. Cannot communicate securely with peer: no common encryption algorithm(s).

Error code: SSL_ERROR_NO_CYPHER_OVERLAP
</code></pre>
<p>The functioning virtual service/gateway looks like this...</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: ingress-gateway
  namespace: istio-system
  annotations:
    kubernetes.io/ingress.global-static-ip-name: earth-616
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http2
        protocol: HTTP2
      hosts:
        - &quot;*&quot;
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: test-app
  namespace: foo
spec:
  hosts:
    - &quot;*&quot;
  gateways:
    - &quot;istio-system/ingress-gateway&quot;
  http:
    - match:
        - uri:
            exact: /
      route:
        - destination:
            host: test-app
            port:
              number: 8000
</code></pre>

<p>Pointing k8s ingress towards istio ingress would result in additional latency and additional requirement for the istio gateway to use <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/" rel="nofollow noreferrer">ingress sni passthrough</a> to accept the HTTPS (already TLS terminated traffic).</p>
<p>Instead the best practice here would be to use the certificate directly with istio Secure Gateway.</p>
<p>You can use the certificate and key issued by Google CA. e.g. from <a href="https://cloud.google.com/certificate-authority-service" rel="nofollow noreferrer">Certificate Authority Service</a> and create a k8s secret to hold the certificate and key. Then configure istio Secure Gateway to terminate the TLS traffic as documented in <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/secure-ingress/" rel="nofollow noreferrer">here</a>.</p>
