<p>I am trying to enable <code>https</code> using the following documentation <strong>[Emissary ingress 2.2.2]</strong>
<a href="https://www.getambassador.io/docs/emissary/latest/howtos/tls-termination/" rel="nofollow noreferrer">https://www.getambassador.io/docs/emissary/latest/howtos/tls-termination/</a></p>
<p>I followed these steps to enable https:</p>
<p>i) Create a self-signed certificate</p>
<pre><code>openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -subj '/CN=ambassador-cert' -nodes
</code></pre>
<p>ii) Store the certificate and key in a Kubernetes Secret</p>
<pre><code>kubectl create secret tls tls-cert --cert=cert.pem --key=key.pem -n test-namespace
</code></pre>
<p>iii) Tell Emissary-ingress to use this secret for TLS termination</p>
<pre><code>apiVersion: getambassador.io/v3alpha1
kind: Host
metadata:
  name: wildcard-host
spec:
  hostname: &quot;*&quot;
  acmeProvider:
    authority: none
  tlsSecret:
    name: tls-cert
  selector:
    matchLabels:
      hostname: wildcard-host
</code></pre>
<p>iv) Applied this manifest</p>
<pre><code>kubectl apply -f wildcard-host.yaml -n test-namespace
</code></pre>
<p>I verified Emissary-ingress service is listening on 443 and forwarding to port 8443.</p>
<p>Also I have mapped node service with it.</p>
<pre><code>apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: node-service-mapping
  namespace: test-namespace
spec:
  hostname: &quot;*&quot;
  prefix: /node-service  
  service: node-service
</code></pre>
<p>But when I send request to backend service with curl</p>
<pre><code>curl -Lk https://{{AMBASSADOR_IP}}/node-service
</code></pre>
<p>I am getting following error [attached screenshot]:</p>
<pre><code>  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0

curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number
</code></pre>
<p><a href="https://i.stack.imgur.com/0Luus.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0Luus.png" alt="enter image description here" /></a></p>
<p>Just for information: I am using following kubernetes cluster version</p>
<pre><code>kubectl version --short
</code></pre>
<p><strong>Client Version: v1.19.0</strong></p>
<p><strong>Server Version: v1.21.7</strong></p>
<p>Appropriate Listener definitions for both http and https:</p>
<pre><code>apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: http-listener
spec:
  port: 8080
  protocol: HTTPS # NOT A TYPO
  securityModel: XFP
  hostBinding:
    namespace:
      from: SELF  
---
apiVersion: getambassador.io/v3alpha1
kind: Listener
metadata:
  name: https-listener
spec:
  port: 8443
  protocol: HTTPS
  securityModel: XFP
  hostBinding:
    namespace:
      from: SELF 
</code></pre>
<p>I followed this document for adding listeners: <a href="https://www.getambassador.io/docs/emissary/latest/howtos/configure-communications/#listeners" rel="nofollow noreferrer">https://www.getambassador.io/docs/emissary/latest/howtos/configure-communications/#listeners</a></p>
<p><strong>I also tried to use the original certificate but that too also didn't worked.</strong></p>
<p>What am I doing wrong here? Why I am getting this error and not able to hit https ? How can I resolve it? How should I debug the issue here? I tried to find several solutions for this error on stackoverflow website and other sites, but was not able to get proper solution for it till now. This link is also related to my question here <a href="https://stackoverflow.com/questions/68410482/how-can-i-use-ambassador-emissary-ingress-for-tls">How can I use Ambassador Emissary -ingress for TLS?</a> . But I didn't find answer for it.</p>
<p>Would appreciate if anyone provide solution for this. Thanks in advance!</p>

Amuk Saxena
<p>I've been struggling with exactly the same problem for a few evenings, - been following the official docs, but got stuck at getting &quot;wrong version number&quot; error when trying to access k8s dashboard over HTTPS with curl,</p>
<p>what solve the problem for me, was an explicit setting of tls-certificate for a host. A &quot;wildcard&quot; host block described in the docs, alone, doesn't seem to work, so, apart from setting a wildcard Host, I've also set another one, specific to k8s dashboard endpoint:</p>
<pre><code>---
apiVersion: getambassador.io/v3alpha1
kind: Host
metadata:
  name: &quot;kubernetes-dashboard-dns&quot;
  # namespace: &quot;kubernetes-dashboard&quot;
  annotations:
    external-dns.ambassador-service: emissary-ingress.emissary
spec:
  hostname: &quot;dashboard.mydomain.tld&quot;
  tlsSecret:
    name: tls-cert
</code></pre>
