<p>I'm trying to run Telegram bot using webhook and always have the same error while trying to perform any request e.g. <a href="https://api.telegram.org/botTOKEN/getWebhookInfo" rel="nofollow noreferrer">https://api.telegram.org/botTOKEN/getWebhookInfo</a>.</p>
<p>My setup:</p>
<blockquote>
<p>Kubernetes/Istio -&gt; Istio Gateway -&gt; nginx -&gt; python-telegram-bot</p>
</blockquote>
<ol>
<li><p>I issued a certificate with LetsEncrypt and set it for Istio gateway for a sub domain as I always do. If I go here <a href="https://www.ssllabs.com/ssltest/analyze.html" rel="nofollow noreferrer">https://www.ssllabs.com/ssltest/analyze.html</a> to check my certificate it returns that everything is set correctly and I can see certificate information.</p>
</li>
<li><p>I setup nginx behind istio gateway (it is already used for other endpoints so I just add the following rules). Gateway forwards 443 port to nginx 80:</p>
</li>
</ol>
<pre><code>server {
        listen 80;
        server_name DOMAIN;

        location /${TG_BOT_TOKEN} {
            proxy_pass http://pp-telegram-bot.default.svc.cluster.local:8000/${TG_BOT_TOKEN}/;
        }

        location /check {
            return 200 'true';
        }
    }
</code></pre>
<p>I checked that this setup works correctly with certificate by making a request to <code>/check</code> endpoint with https - all works fine.</p>
<ol start="3">
<li>Next I setup a bot with <code>python-telegram-bot</code></li>
</ol>
<pre><code>bot = telegram.Bot(token=TG_BOT_TOKEN)

def main():
    updater = Updater(bot=bot, use_context=True)

    dispatcher = updater.dispatcher
    # add handlers

    updater.start_webhook(listen='0.0.0.0', port=8000, url_path=TG_BOT_TOKEN)
    updater.bot.set_webhook(f'https://{DOMAIN}/{TG_BOT_TOKEN}')
    updater.idle()

if __name__ == '__main__':
    main()
</code></pre>
<ol start="4">
<li>I run the setup. Everything is working, no crash. Trying to check with: <a href="https://api.telegram.org/botTOKEN/getWebhookInfo" rel="nofollow noreferrer">https://api.telegram.org/botTOKEN/getWebhookInfo</a> and got the following response:</li>
</ol>
<pre><code>{
    &quot;ok&quot;: true,
    &quot;result&quot;: {
        &quot;url&quot;: &quot;https://DOMAIN/TOKEN&quot;,
        &quot;has_custom_certificate&quot;: false,
        &quot;pending_update_count&quot;: 1,
        &quot;last_error_date&quot;: 1610810736,
        &quot;last_error_message&quot;: &quot;Wrong response from the webhook: 426 Upgrade Required&quot;,
        &quot;max_connections&quot;: 40,
        &quot;ip_address&quot;: IP_ADDRESS
    }
}
</code></pre>
<p>No logs for bot app available. Nginx logs display only a general one liner error: <code>&quot;POST /TOKEN HTTP/1.1&quot; 426 0 &quot;-&quot; &quot;-&quot; &quot;10.244.1.13&quot;</code></p>
<p>What I tried:</p>
<ul>
<li>Export certificate from k8s to pem file and use it in <code>set_webhook</code>. But that should not be the case since it is not self signed certificate and look like SSL part works ok (maybe not).</li>
<li>Use <code>127.0.0.1</code> instead of <code>0.0.0.0</code></li>
<li>remove <code>updater.idle()</code></li>
<li>Setting webhook by myself from terminal</li>
<li>Reread this manual many times <a href="https://core.telegram.org/bots/webhooks" rel="nofollow noreferrer">https://core.telegram.org/bots/webhooks</a></li>
<li>I even tried to set webhook url to <code>/check</code> for Telegram and it actually stats return correct response (probably because this endpoint returns just 200) but obviously there is no bot behind that URL.</li>
</ul>
<p>All the above tells me that probably something is wrong with the bot setup itself, but everything looks correct according to python-telegram-bot manual.</p>
<p>Last but not least, if I use <code>getUpdates</code> instead of webhook bot works perfectly fine.</p>
<p>So I have no idea what this 426 error means in that context and how to make it work.</p>
<p>Headers:
<a href="https://i.stack.imgur.com/XqBvr.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XqBvr.png" alt="enter image description here" /></a></p>

Max
<p>You must explicitly set <code>proxy_http_version</code> to 1.1 to make it work, otherwise it uses 1.0 by default.</p>
<pre><code>server {
    listen 80;
    server_name DOMAIN;

    location /${TG_BOT_TOKEN} {
        proxy_http_version  1.1;
        proxy_pass http://pp-telegram-bot.default.svc.cluster.local:8000/${TG_BOT_TOKEN}/;
    }
}
</code></pre>
