<p>My platform version:</p>
<ul>
<li>AWS EKS 1.18</li>
<li>istio 1.7.3</li>
</ul>
<p>Hi, I have a problem when requesting via https.
When I try to connect to &quot;https://kinesis.ap-northeast-2.amazonaws.com&quot; on ssl, I get ssl3_get_record:wrong version number error.
However, SSL requests to &quot;https://www.amazon.com&quot; is working. Http request to &quot;kinesis.ap-northeast-2.amazonaws.com:443&quot; is also working.
FYI, https request to kinesis on the router proxy is also working. I think this problem occurs with the sidecar proxy.
Could you tell me how to fix it?</p>
<p>My debug log:</p>
<pre><code>istio-proxy@xx-deployment-1:/$ curl https://kinesis.ap-northeast-2.amazonaws.com # SSL ERROR
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

istio-proxy@xx-deployment-1:/$ openssl s_client -connect kinesis.ap-northeast-2.amazonaws.com:443 -prexit -debug
CONNECTED(00000005)
write to 0x55da2e01a630 [0x55da2e02cbb0] (338 bytes =&gt; 338 (0x152))
0000 - 16 03 01 01 4d 01 00 01-49 03 03 d1 6c 8f 02 46   ....M...I...l..F
....
0150 - a6 18                                             ..
read from 0x55da2e01a630 [0x55da2e0238a3] (5 bytes =&gt; 5 (0x5))
0000 - 15 00 00 00 02                                    .....
140165107823040:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:../ssl/record/ssl3_record.c:332:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 5 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes =&gt; 9 (0x9))
0000 - 02 28 15 00 00 00 02 01-00                        .(.......
read from 0x55da2e01a630 [0x55da2e011d80] (8192 bytes =&gt; 0 (0x0))
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 14 bytes and written 338 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
</code></pre>
<hr />
<p>http request on port 443 test:</p>
<pre><code>root@xx-deployment-576c874974-g8pnn:/usr/src/app# curl -iv http://kinesis.ap-northeast-2.amazonaws.com:443
* Rebuilt URL to: http://kinesis.ap-northeast-2.amazonaws.com:443/
*   Trying 54.230.155.14...
* TCP_NODELAY set
* Connected to kinesis.ap-northeast-2.amazonaws.com (54.230.155.14) port 443 (#0)
&gt; GET / HTTP/1.1
&gt; Host: kinesis.ap-northeast-2.amazonaws.com:443
&gt; User-Agent: curl/7.52.1
&gt; Accept: */*
&gt; 
&lt; HTTP/1.1 400 Bad Request
HTTP/1.1 400 Bad Request
&lt; Server: CloudFront
Server: CloudFront
&lt; Date: Wed, 10 Mar 2021 07:51:49 GMT
Date: Wed, 10 Mar 2021 07:51:49 GMT
&lt; Content-Type: text/html
Content-Type: text/html
&lt; Content-Length: 915
Content-Length: 915
&lt; Connection: close
Connection: close
&lt; X-Cache: Error from cloudfront
X-Cache: Error from cloudfront
&lt; Via: 1.1 3dd24013b0b99bf4ea490be8808572d8.cloudfront.net (CloudFront)
Via: 1.1 3dd24013b0b99bf4ea490be8808572d8.cloudfront.net (CloudFront)
&lt; X-Amz-Cf-Pop: ICN51-C2
X-Amz-Cf-Pop: ICN51-C2
&lt; X-Amz-Cf-Id: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
X-Amz-Cf-Id: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==

&lt; 
&lt;!DOCTYPE HTML PUBLIC &quot;-//W3C//DTD HTML 4.01 Transitional//EN&quot; &quot;http://www.w3.org/TR/html4/loose.dtd&quot;&gt;
&lt;HTML&gt;&lt;HEAD&gt;&lt;META HTTP-EQUIV=&quot;Content-Type&quot; CONTENT=&quot;text/html; charset=iso-8859-1&quot;&gt;
&lt;TITLE&gt;ERROR: The request could not be satisfied&lt;/TITLE&gt;
&lt;/HEAD&gt;&lt;BODY&gt;
&lt;H1&gt;400 ERROR&lt;/H1&gt;
&lt;H2&gt;The request could not be satisfied.&lt;/H2&gt;
&lt;HR noshade size=&quot;1px&quot;&gt;
Bad request.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
&lt;BR clear=&quot;all&quot;&gt;
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
&lt;BR clear=&quot;all&quot;&gt;
&lt;HR noshade size=&quot;1px&quot;&gt;
&lt;PRE&gt;
Generated by cloudfront (CloudFront)
Request ID: ZffqQUOQWMUZaVaejuWuy0QTeVrpa47cFhWq7ion4aM2jj7nR17v4w==
&lt;/PRE&gt;
&lt;ADDRESS&gt;
&lt;/ADDRESS&gt;
* Curl_http_done: called premature == 0
* Closing connection 0
</code></pre>
<p>My istio proxy config:</p>
<pre><code>  proxy:
    autoInject: enabled
    clusterDomain: cluster.local
    componentLogLevel: 'misc:error'
    enableCoreDump: false
    excludeIPRanges: ''
    excludeInboundPorts: ''
    excludeOutboundPorts: ''
    image: proxyv2
    logLevel: warning
    privileged: false
    readinessFailureThreshold: 30
    readinessInitialDelaySeconds: 1
    readinessPeriodSeconds: 2
    resources:
      limits:
        cpu: 2000m
        memory: 1024Mi
      requests:
        cpu: 100m
        memory: 128Mi
    statusPort: 15020
    tracer: zipkin
  proxy_init:
    image: proxyv2
    resources:
      limits:
        cpu: 2000m
        memory: 1024Mi
      requests:
        cpu: 10m
        memory: 10Mi
</code></pre>
<p>My sidecar proxy container spec:</p>
<pre><code>- name: istio-proxy
  image: 'docker.io/istio/proxyv2:1.7.3'
  args:
    - proxy
    - sidecar
    - '--domain'
    - $(POD_NAMESPACE).svc.cluster.local
    - '--serviceCluster'
    - xx.$(POD_NAMESPACE)
    - '--proxyLogLevel=warning'
    - '--proxyComponentLogLevel=misc:error'
    - '--trust-domain=cluster.local'
    - '--concurrency'
    - '2'
</code></pre>
<p>My gateway container spec:</p>
<pre><code>  containers:
    - name: istio-proxy
      image: 'docker.io/istio/proxyv2:1.7.3'
      args:
        - proxy
        - router
        - '--domain'
        - $(POD_NAMESPACE).svc.cluster.local
        - '--proxyLogLevel=warning'
        - '--proxyComponentLogLevel=misc:error'
        - '--log_output_level=default:info'
        - '--serviceCluster'
        - xx-gateway
        - '--trust-domain=cluster.local'
</code></pre>

mjkim
<p>I created another EKS cluster to test this error.
So, I figured out the problem was in this istio config.</p>
<pre><code>spec:
 values:
  global:
   podDNSSearchNamespaces:
    - global
</code></pre>
<p>After I deleted &quot;podDNSSearchNamespaces&quot; key, https worked.</p>
