<p>I have a service with a self signed SSL cert that I want to expose to the internet. I would like Istio Gateway to terminate the SSL connection (using a cert from cert-manager) and the istio sidecar to handle HTTPS traffic internally to the backend service.</p>
<p>However when I try this I get errors from Envoy:</p>
<pre><code>TLS error: 268435648:SSL routines:OPENSSL_internal:PEER_DID_NOT_RETURN_A_CERTIFICATE
</code></pre>
<p>My backend service is exposed like so:</p>
<pre><code>---
kind: VirtualService
apiVersion: networking.istio.io/v1alpha3
metadata:
  name: stratos
  namespace: stratos
spec:
  gateways:
    - cf-system/istio-ingressgateway
  hosts:
    - console.example.com
  http:
    - route:
        - destination:
            host: console-ui-ext
            
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: stratos
  namespace: stratos
spec:
  host: console-ui-ext
  trafficPolicy:
    tls:
      mode: SIMPLE

---
kind: Gateway
SNIP
  - hosts:
    - console.example.com
    port:
      name: https-workloads
      number: 443
      protocol: HTTPS
    tls:
      credentialName: my-cert
      mode: SIMPLE
</code></pre>
<p>In the istio-sidecar, I can <code>curl -k https://localhost</code> without issue. However I get an SSL error when I use <code>curl -k https://console-ui-ext.stratos.svc.cluster.local</code></p>
<p>What am I missing? One thing I found weird was the routes added to Envoy are all <code>outbound|443</code> I would have expected to see inbound routes there as well. I do not want TLS passthrough on the Gateway since the certificate of the backend service is not valid.</p>
<p>Istio is using a <code>STRICT</code> mTLS setting.</p>
<p>Is there a step I forgot when having a HTTPS backend?</p>

Chaos
<p>Turns out this was due to mTLS being strict. The sidecar was not expecting just TLS traffic to arrive causing the issue. Disabling mTLS for this app resolved my issue.</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: stratos
  namespace: stratos
spec:
  mtls:
    mode: DISABLE
</code></pre>
