<p>I am unable to get the TLS termination at nginx ingress controller working on my kubernetes cluster.</p>

<p>my ingress rule looks as the following : </p>

<pre><code>Christophers-MacBook-Pro-2:acme-microservice cjaime$ kubectl describe ing myapp-ingress-1
Name:             myapp-ingress-1
Namespace:        default
Address:          
Default backend:  default-http-backend:80 (&lt;none&gt;)
TLS:
 acme-io terminates myapp-default.acme.io
Rules:
 Host                            Path  Backends
 ----                            ----  --------
 myapp-default.acme.io  
                                 /   myapp:80 (&lt;none&gt;)
Annotations:
 ingress.kubernetes.io/ssl-redirect:  true
 kubernetes.io/ingress.class:         nginx
Events:
 Type    Reason  Age               From                      Message
 ----    ------  ----              ----                      -------
 Normal  UPDATE  53m (x2 over 1h)  nginx-ingress-controller  Ingress default/myapp-ingress-1
 Normal  UPDATE  53m (x2 over 1h)  nginx-ingress-controller  Ingress default/myapp-ingress-1
 Normal  UPDATE  53m (x2 over 1h)  nginx-ingress-controller  Ingress default/myapp-ingress-1
 Normal  UPDATE  53m (x2 over 1h)  nginx-ingress-controller  Ingress default/myapp-ingress-1
</code></pre>

<p>Whenever I try to access this from the browser I get the back the following server certificate</p>

<pre><code>Server certificate
subject=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
issuer=/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
</code></pre>

<p>This is preventing me from creating a valid SSL connection. I know my secret is correct because when using openssl I get a valid connection as follows</p>

<pre><code>openssl s_client -servername myapp-default.acme.io -connect us1a-k8s-4.acme.io:31443 -showcerts
CONNECTED(00000003)

&lt;content omitted&gt;

   Start Time: 1528241749
   Timeout   : 300 (sec)
   Verify return code: 0 (ok)
---
</code></pre>

<p>However If I run the same command with the servername omitted I get the same fake certificate and a connection error</p>

<pre><code>openssl s_client  -connect us1a-k8s-4.acme.io:31443 -showcerts
CONNECTED(00000003)
depth=0 O = Acme Co, CN = Kubernetes Ingress Controller Fake Certificate
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 O = Acme Co, CN = Kubernetes Ingress Controller Fake Certificate
verify error:num=21:unable to verify the first certificate
verify return:1
---
Certificate chain
0 s:/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate
  i:/O=Acme Co/CN=Kubernetes Ingress Controller Fake Certificate

&lt;content omitted&gt;

   Start Time: 1528241957
   Timeout   : 300 (sec)
   Verify return code: 21 (unable to verify the first certificate)
</code></pre>

hackmabrain
<p>Your tests with openssl are executed correctly and they show that nginx does offer the valid certificate for <strong>myapp-default.acme.io</strong> when that hostname is provided in the request via <a href="https://en.m.wikipedia.org/wiki/Server_Name_Indication" rel="nofollow noreferrer">SNI</a>. This is in harmony with what you configured in the Ingress.</p>

<p>For other hostnames or requests without a hostname the <strong>default certificate</strong> is sent. That certificate is to be stored in a Secret and configured via a command line parameter to the ingress controller (<code>--default-ssl-certificate=$(POD_NAMESPACE)/tls-ingress</code>).</p>

<p>Your browser warning was either because of a mismatch in the hostname or a cached fake certificate in your browser. I suggest you look up how flush the certificate cache in your b browser and/or redo the test with curl:</p>

<pre><code>curl -v https://myapp-default.acme.io
</code></pre>

<p>If it still does not work correctly, you may be affected by <a href="https://github.com/kubernetes/ingress-nginx/issues/1954" rel="nofollow noreferrer">#1954</a> - update nginx-ingress-controller.</p>
