<p>I am exploring the istio service mesh on my k8s cluster hosted on EKS(Amazon).</p>

<p>I tried deploying istio-1.2.2 on a new k8s cluster with the demo.yml file used for bookapp demonstration and most of the use cases I understand properly. </p>

<p>Then, I deployed istio using helm default profile(recommended for production) on my existing dev cluster with 100s of microservices running and what I noticed is my services can can call http endpoints but not able to  call external secure endpoints(<a href="https://www.google.com" rel="nofollow noreferrer">https://www.google.com</a>, etc.) </p>

<p>I am getting :</p>

<blockquote>
  <p>curl: (35) error:1400410B:SSL routines:CONNECT_CR_SRVR_HELLO:wrong
  version number</p>
</blockquote>

<p>Though I am able to call external https endpoints from my testing cluster.</p>

<p>To verify, I check the egress policy and it is <strong>mode: ALLOW_ANY</strong> in both the clusters.</p>

<p>Now, I removed the the istio completely from my dev cluster and install the demo.yml to test but now this is also not working. </p>

<p>I try to relate my issue with this but didn't get any success.</p>

<p><a href="https://discuss.istio.io/t/serviceentry-for-https-on-httpbin-org-resulting-in-connect-cr-srvr-hello-using-curl/2044" rel="nofollow noreferrer">https://discuss.istio.io/t/serviceentry-for-https-on-httpbin-org-resulting-in-connect-cr-srvr-hello-using-curl/2044</a> </p>

<p>I don't understand what I am missing or what I am doing wrong.</p>

<p>Note: I am referring to this setup: <a href="https://istio.io/docs/setup/kubernetes/install/helm/" rel="nofollow noreferrer">https://istio.io/docs/setup/kubernetes/install/helm/</a></p>

Vaibhav Jain
<p>This is most likely a bug in Istio (see for example <a href="https://github.com/istio/istio/issues/14520" rel="nofollow noreferrer">istio/istio#14520</a>): if you have any Kubernetes Service object, anywhere in your cluster, that listens on port 443 but whose name starts with <code>http</code> (not <code>https</code>), it will break all outbound HTTPS connections.</p>

<p>The instance of this I've hit involves configuring an AWS load balancer to do TLS termination.  The Kubernetes Service needs to expose port 443 to configure the load balancer, but it receives plain unencrypted HTTP.</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Service
metadata:
  name: breaks-istio
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:...
    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
spec:
  selector: ...
  ports:
    - name: http-ssl # &lt;&lt;&lt;&lt; THIS NAME MATTERS
      port: 443
      targetPort: http
</code></pre>

<p>When I've experimented with this, changing that <code>name:</code> to either <code>https</code> or <code>tcp-https</code> seems to work.  Those <a href="https://istio.io/docs/setup/kubernetes/additional-setup/requirements/" rel="nofollow noreferrer">name prefixes</a> are significant to Istio, but I haven't immediately found any functional difference between telling Istio the port is HTTPS (even though it doesn't actually serve TLS) vs. plain uninterpreted TCP.</p>

<p>You do need to search your cluster and find <em>every</em> Service that listens to port 443, and make sure the port name doesn't start with <code>http-...</code>.</p>
