<p>I want to call a REST service running outside OpenShift via a Service and external domain name. This works perfect with a http:// request. The mechanism is described in the documentation : <a href="https://docs.okd.io/latest/dev_guide/integrating_external_services.html#saas-define-service-using-fqdn" rel="nofollow noreferrer">https://docs.okd.io/latest/dev_guide/integrating_external_services.html#saas-define-service-using-fqdn</a></p>

<p>However the external service is secured with https. In this case I got the following exception: 
Host name 'external-test-service' does not match the certificate subject provided by the peer (CN=<em>.xxx, O=xxx, L=xxx, ST=GR, C=CH); nested exception is javax.net.ssl.SSLPeerUnverifiedException: Host name 'external-test-service' does not match the certificate subject provided by the peer (CN=</em>.xxx, O=xxx, L=xxx, ST=GR, C=CH)</p>

<p>The exception is clear to me because we use the Service name from OpenShift. This name does not correspond to the origin host name in the certificate. So currently I see three possibilities to solve this issue:</p>

<ol>
<li>Add the name of the OpenShift Service to the certificate</li>
<li>Deactivate hostname verification before calling the external REST service</li>
<li>Configure OpenShift (don't know this is possible)</li>
</ol>

<p>Has anybody solve this or a similar issue?</p>

<p>Currently I used OpenShift v3.9. We are running a simple Spring Boot application in a pod accessing REST services outside OpenShift.</p>

<p>Any hint will be appreciated.</p>

<p>Thank you</p>

<p>Markus</p>

Markus
<ol>
<li>Ugly and might cost you extra $$</li>
<li>Defeats the purpose of TLS.</li>
<li><p>On Kubernetes 1.10 and earlier you can use <a href="https://kubernetes.io/docs/concepts/services-networking/service/#externalname" rel="nofollow noreferrer">ExternalName</a>. </p>

<p>You can also use with <a href="https://docs.openshift.com/container-platform/3.3/dev_guide/integrating_external_services.html#mysql-define-service-using-fqdn" rel="nofollow noreferrer">OpenShift</a>.</p></li>
<li><p>You can also use and <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="nofollow noreferrer">Kubernetes Ingress</a> with <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/#tls" rel="nofollow noreferrer">TLS</a>. Also, documented for <a href="https://github.com/nginxinc/kubernetes-ingress/tree/master/examples/openshift" rel="nofollow noreferrer">OpenShift</a></p></li>
</ol>

<p>Hope it helps!</p>
